Sure. The JVM was engineered to include sandboxing for unsafe functions (disk access, for example). Lua allows quite granular sandboxing (look at what WoW takes away).
You're comparing apples and oranges here. You can run PHP in "safe mode", as many shared hosts do, to prevent shell access and disk access by PHP code.
The only problem here is one of misplaced trust (and perhaps WordPress allowing PHP in templates instead of using a dedicated templating language). People installing WordPress templates generally a) don't care where they come from and b) don't even read the source code, so this theme could probably include such links without any obfuscation and still successfully spread.
No, but the problem is that the spammy code is being obfuscated using eval() and base64 encoding.
> You can run PHP in "safe mode", as many shared hosts do, to prevent shell access and disk access by PHP code.
Sure, so why have other unsafe methods?
I agree that social attacks cannot be completely prevented through technical means, but there's no reason to make it easy.