Well, the public website of the NCSC is offline. Who knows what crazy proprietary stuff they have.
[EDIT: I see I may have erroneously extended your criticism to sites other than NCSC, for which it does make sense. I would still defend using PHP.]
Now are there more powerful tools out there that result in more scalable websites? Sure. My personal sites are built around static site generators for that exact reason. But none of better tools are as easy to understand for non-programmers as wordpress or one of the other click-and-drag CMS tools.
That you want your content to be readable from everyone doesn’t mean you want the admin interface to be available globally.
Sometimes, they just want to send spam. Ages ago, someone got a hold of our company's webserver and all they used it for was sending a ridiculous volume of emails. Our ISP spotted the traffic spike and pulled our server off the network.