Security really was (still is?) a WordPress concern. PHP itself isn't really a security issue, security will come from the code you write rather than the language itself