You are right again. But I will complicate the installation. The PHP files are secure, they are classes ore arrays. if you execute them nothing happens. We have an .htaccess file in core applications folder. The .htacces file rejects all requests.

We would provide security tips also for nginx users. Just to repeat all files except index.php are classes ore arrays and and they don't execute any code.