That's a silly blanket statment. There are times a system call is nessessary. Also there's a lot more ways to get system calls than you list, namely the deadly back tick operator, as well as process control just as a start.
Update: Also curl_exec? cUrl is how you do ANYTHING http more advanced than fetching with a few headers. Everything that accesses any sort of API in a serious manner will use cUrl.
Of course, no matter the language used, input sanitising is essential.
Edit: Since you've edited your post to add cURL to your criticism, please note I originally replied "These are best done with a non-scripted program or perhaps Python" for exactly this reason.
Much of the criticism of PHP can be leveled against its misuse as much as the language's own shortcomings.
Think of it this way; if a layer of your stack has the capability to destroy a system, it's probably best left speaking to another layer that actually speaks to a user.
PHP for web and Python for backend is not a foreign concept and so it makes little sense to apply one hammer to all variety of nails.