I know from personal experience how nasty raw PHP templating can be, in a sprawling codebase where no one ever considered that simply echoing variables that came from the database or from request variables might be a bad idea.

It makes even a simple framework more complicated but people use frameworks to not have to be bothered about that sort of thing.

You may want to take a look at this before proceeding: https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet