That's a false dichotomy. PHP is mainly used in creating web pages, and a scripting language is not a requirement there.
If you compare it with production languages, PHP looks pretty weak.
If you compare it with production languages, PHP looks pretty weak.
8f your comparison excludes all the vulnerabilities they come with, sure.
In practice no one using Node is using it without npm. Same for every other language that has insane transitive dependencies for any non-trivial project.
PHP is no more vulnerable than those languages.
In theory, perhaps not. In practice, much more vulnerable.
PHP applications might do suspicious things, by choice. But the runtime itself is fine. Certainly, there are less vulnerabilities in recent years in the PHP runtime than in, say, V8.