> the server may still prioritize an exact path match and execute the file rather than defaulting to executing the framework's entrypoint

This is properly solved by frameworks having this entrypoint be in a ‘public’ folder and that also being the webroot, so only index.php and nothing else is available for a direct match (unless /../ in the url works, which would be a huge security hole).