This is a valid and secure set up - and should be considered if you are running your own Wordpress site - but not the standard in shared hosting. Most users are

This is a valid and secure set up - and should be considered if you are running your own Wordpress site - but not the standard in shared hosting. Most users are isolated from each other and run php under their user name. A reasonable shared host will have some security set up that will protect their clients, and there are plenty to outsource to. This type of exploit is blocked for example using imunify360 with php defense and the waf rules while allowing php to run under the username.