Not if the security vulnerability does not also lead to root privileges.
There's many other ways to go about it too without granting that capability (like port redirection, reverse proxy tunnel etc).
In fact I would say these days, no one should be running php or any web stack as root unless you've got very good reasons to do so.