Because every once-in-a-lifetime AI is invented and finds security flaws in PHP? Seems like you are coming to an overly broad conclusion here. Besides, you have to serve the static HTML somehow, and Apache and Nginx have had plenty of security vulnerabilities.