I worked with PHP back in 2014 and nobody was building anything in PHP that could be called advanced by today's standards. That language barely had decent backend framework options and we're talking just 10 years ago.

If this person has been working for 20 years, they were definitely working at the time when MD5 hashing was considered security in the PHP community and the best technology that community could muster at the time was the horrifying architecture of WordPress.

I'm sorry, I'm sure this fella is a good engineer but you could not convince me that back in the day PHP had anything going on for it except for low barrier of entry.