Where are these numbers coming from? This seems completely divergent from the statistics here:
140 karma · joined October 21, 2013
But you're coming from the right place - it's absolutely the job of the programming language to at least make it more difficult to do so and encouraging good security practices, and PHP does not do a very good job of that. Then again, I write JavaScript for a living so I suppose I don't have much room to criticize on that front.