I.e. delware’s rasion d’etre for decades anyway. A tax haven banana state with no identity beyond being the place people register businesses.

The usage of PHP in enterprise appliances is actually pretty wild - many firewalls, load balancers etc are using PHP for management plane activities. There is a lot out there outside of userland, and those are the appliances most vulnerable in my opinion. A compromised firewall is worse than a compromised website.

That does sound like a bit of a risk. Similar to how high frequency trading affects stability of shares and elevates risk of mass sell-offs - if these agents had enough use from the general public, they could easily impact the stability of a bank.