It's out of proportion. Take as many Django/Rails/ASP.Net exploited sites that you find and it won't hold a candle to PHP.

Also, want to talk Java? Let's not forget that log4j was exploited precisely because of implicit string conversions.

Implicit f-strings are a really bad idea.