Are you not allowed to install a new version of PHP? Because isn't it more worrying that you are using versions of PHP that are EOL?
That's actually one of the main points of an LTS distribution. They run the same version of languages, databases, web servers, firewalls, and everything else at the end that they did at the start, so that you get a stable platform throughout their lifetime.
If you go down the road of updating individual components to something significantly newer than what your distribution supports you can easily end up breaking other things--so then those need to be updated too, which might break more.
Even if that doesn't break anything else (and PHP would probably not...offhand I can't think of anything that I need in Debian that depends on PHP so switching to a later PHP would probably be safe on that front), it leaves you with software that isn't covered by your distribution's regular updates. For each such thing you install, you've got to put in place some way to find when the upstream has a bug fix or security fix you need, and some way to get and apply that.