Remember that setting up a reverse shell only requires a networkable shell (like bash). Most linuxes (including containers) there for have the capability of having reverse shells started on them. The way to protect abuse of PHP’s webserver function is the same as the one to protect against bash reverse shells. Do not allow any outbound traffic but only traffic you trust!
Do not blame php for having a feature that others have had for years. PHP’s version is no better or worse than any of them.
What I hate is the idea of putting something on a server that's going to make my life harder, or create more work for my team. I don't want the developers I work with having to give up their evenings or weekends to resolve issues and incidents that arose from things shouldn't have existed in the first place. That's why I don't want additional network services sneaking their way on to production. I should very easily be able to tell which applications on a server are listening to external traffic.
Maintaining good security is hard enough without language runtimes including things that should strictly only ever be a development dependency rather than a production dependency.
If there are pills I can take to make this problem go away, sign me up.
As for security you must keep up with the capabilities of the tools you use. Php has been able to run as a webserver for years (even before 5) all they did is implement a good sane dev server to run php code without setting up a complex php environment (that is probably less secure).