Comment by AndroTux

Maybe that’s because you’ve only worked with WordPress with tons of unpatched plugins.

Every programming language has security vulnerabilities. PHP doesn’t have any more than others.