It appears to be a pretty serious issue. The SQL injection alone is bad but the ability to run basically any PHP code through callbacks makes the problem that much worse.
I don't think it's that often. By default, a new MySQL user will not have FILE privileges granted.
Most of the time you see this due to the developer being lazy and just using the "root" MySQL user.