> The smart contracts running on Ethereum are open source, unlike your PHP script, can be audited, and if marked immutable, i'm sure no malicious person/business can hack or change it

And equally sure that any bug in there (and there will be bugs in there) is unfixable and any funds stolen through it unretrievable.

"smart contracts" are neither.