No one mentioned magic. Frameworks are designed to do what PHP developers wind up implementing in an ad-hoc, haphazard way themselves, and tend to be better at doing it on average. Any code can have security issues but I'd trust a battle-hardened open source PHP framework over some random coder's hubris any day of the week.
Not any more so than sites with frameworks. I’ve found XSS issues in Java Spring framework built sites that didn’t “do things exactly right”. A framework doesn’t magically fix that.