There is always this idea that the most used software also has the most vulnerabilities, but I think its an interesting question if this is actually true in light of AI. Like humans wouldn't spend a combined 100,000 hours or something looking at some obscure code, but an AI might do the equivalent across the entire ecosystem. Like if this idea is really true, we should see CVE's go into the millions per year soon, although I guess for now it's still bounded by compute budget but I question if the initial premise is true to begin with or if PHP is just shit. /s