Why is the only PHP defence i hear always the same "use a framework!". I did those for decades, and they always end up sucking. Either you need to hack around them, they have shitty defaults and finally they are abandoned and bitrot without any way of rewriting because of the huge size of the app.

How about just write the code, using the stdlib and picking highly focused libraries for things you dont want to write (crypto, drivers etc.) your self.