The usage of PHP in enterprise appliances is actually pretty wild - many firewalls, load balancers etc are using PHP for management plane activities. There is a lot out there outside of userland, and those are the appliances most vulnerable in my opinion. A compromised firewall is worse than a compromised website.