I would suggest having a try_files in the .php location. Because it just takes someone sending a request to index.php for Nginx to process the request in a pote

I would suggest having a try_files in the .php location. Because it just takes someone sending a request to index.php for Nginx to process the request in a potentially vulnerable location block that doesn't have try_files. You perhaps might not be vulnerable if you use an internal directive inside your .php location block.