Indeed it's completely insane that any plugin can create a file in the site folder, and a public URL will execute it. And a site can have a dozen (or dozens in some cases) of plugins from various authors. It's a security nightmare, and I don't know of any (modern) language that allows such a situation other than PHP.