Besides trying to fire at "If this breaks your software, your software is badly written." like other's already did, there's the more obvious fact:

If it's YOUR software, you're supposed to trust it! (yeah, including trusting it that it's not so badly written somebody can inject code into it) ...this type of setting should only make sense for when you have to use dubious quality third-party code (which can happen quite often... WordPress plugins being an obvious example)

...the sensible thing to do is to basically partition your php code base into "trustworthy and/or written by us" and "non-trustworthy" and always run these types of code with different settings, and never mix them, just have services that communicate via APIs.