PHP has thrived due to the mindset of wanting to get pages on the web with the least amount of effort to configure or understand the stack. It's what I've always seen people cite as the reason for adopting PHP. The language isn't simple, it's full of inconsistency, but the deployment is simple, the setup is simple with default Apache and mod_php, the 1:1 correspondence between web pages and files on the filesystem is simple.

It should be expected that the same mindset would lead to unpatched servers and inattention to the nuances of the stack.