I was under the impression that this sort of bug is fairly common in both php and common php frameworks?

I thought the real lesson was "assume your web server is compromised if you use php, and try to make sure php doesn't touch anything too critical"

I'm struggling to see any reason to use PHP in the first place if it can run without access to private data.

At that point I would not need a backend.

Yes, there have been decades of talk about this already—ensuring you isolate/jail the PHP-related processes and run them with an unprivileged user, etc.

It's usually scripts that can write to /tmp and run unrelated stuff with web user rights. This seems more involved.