Agreed, I've pentested php apps and some are very hardened and difficult to breach and I've tested Python django apps where I completely compromised the server. Language has only a weak correlation to security for web applications.