Much of that depends on their justification. It's entirely possible it was made only for broad risk-avoiding reasons due to PHP's reputation at the time (anyone

Much of that depends on their justification. It's entirely possible it was made only for broad risk-avoiding reasons due to PHP's reputation at the time (anyone could have "safely" made that decision, you don't need infosec skills to make that call). They could have done a detailed inventory of what they use and found a bad history of bugs like multiple auth bypasses, trivial RCE. Or they might have audited a few of the products themselves and saw the code quality was typically poor and prone to security issues.