The problem of over-engineering isn't just related to the big PHP frameworks - the same problem exists in Python and Ruby.
At its core, web development is about taking some user input, validating it, throwing it in a database, and displaying it again (perhaps slightly modified) to users. That's a fairly simple concept, and frameworks should reflect that.
I've seen some horrible cases where simple blogs done in wordpress were incrementally extended to the point where they're absolutely unmaintainable, un-updatable monsters.
The marketing manager who says today "I just want a blog" IS going to come back next week and say "I want to a white paper on the blog, for which people have to register, and then it automatically subscribes them to a newsletter".
After enough feature requests, you've built yourself a crap framework anyway. At least, by starting with a decent framework, the foundation of your code is solid.
OTOH, the "complexity" may also be "configurability" or "pluggability" with missing shortcuts. And quite often the "simple" version ends up being insufficient when one needs to tweak something: http://lucumr.pocoo.org/2013/2/13/moar-classes/
> That's a fairly simple concept
When going for pithy statements and omitting most of the actual issues, even encryption, clustering or networking "[are] fairly simple concepts". Which effectively they're not.
Ideally, a framework would have some basic elements and then additional components that can be included if required by a project but aren't core to the framework.
Maybe most HN startups are that, but web development _at it's core_ certainly isn't limited to CRUD apps.