The "realistic setup" used for this didn't have a php page on it initially.

I'm skeptical of the value of such setups, unless it's clear it's an out of the box setup, and we already know those are totally broken.

I don't understand who these people think they are really fooling. Is this some AI denial?

There are many PoCs online that work on realistic setups (like PHP docker image). If you're curious you can try to replicate it locally.