I'm struggling to see any reason to use PHP in the first place if it can run without access to private data.

At that point I would not need a backend.