It doesn't need to. "Large PHP application" just means "at scale", in terms of LoC, and - most likely - contributors. Which means (a) potentially anything may

It doesn't need to. "Large PHP application" just means "at scale", in terms of LoC, and - most likely - contributors. Which means (a) potentially anything may be combined in templates by somebody at some point without careful manual code-review, which is difficult to audit at scale, and (b) there are a larger number of files to audit, likely with a degree of complexity to their overall structure, which further adds to that difficulty.