Most shared hosting plans use cpanel. It's still widely used yes for a lot of smaller websites.

There are a lot of things that have been up for decades. The ROI on moving a simple PHP or static website to new hosting situation hasn’t been that compelling… though that could change. Thing is, I suspect most users of shared hosting which is Cpanel’s bread and butter are not reading the latest cybersecurity news.

CPanel on shared hosting running WordPress PHP is literally half of the entire internet still.

I run an entire saas that 36 companies pay for, built in PHP, and I drag and drop the files to the server via cpanel.