The actual problem is that PHP automatically initializes variables even on read—the same reason all globals have to be manually "imported", even if they're only read from. Similar to the problem Python 3's `nonlocal` solves, except imagine a world where Python didn't have NameErrors and instead initialized every unrecognized name to None.
I suppose they could have made it work differently just for nested functions, but that's a major inconsistency, it's not clear how it would interact with globals, etc.
register globals imported request parameters from the query string and post body into the global variable scope.
having undeclared variables "act like empty strings" is related to non-strict variable comparison (== vs ===) and either silencing errors, or not displaying/caring about them.
of course it could be a security issue without undefined variables coercing to an empty string in string context - it could allow request parameters to override defined variables.