Comment by duskwuff

Yes. The Uber representative implied that a secure web shell would have been, at the very least, less objectionable:

> we noticed that you placed an unauthenticated web shell into our web root

(emphasis mine)

That being said, I imagine a phpinfo(); or passthru("whoami"); would have been preferred.