Perhaps you forgot to check that argumentum ad populatum is still a logical fallacy in 2021.
My company makes up some of those 80% powered by PHP, I make my salary supporting PHP web sites and coding PHP code myself, I even like some of the overall language, and PHP happens to be the first language in which I coded any non-toy programs.
Yet it is still pretty much THE shitty language. A primer on how you DO NOT create a programming language, from security hell to just absurd language features that trip you on every step. You wouldn't need to look past what kind of absolute crap has to be fixed with breaking changes in each major release that's came out in recent years. For example, the recently released PHP 8 fixes the absolute insanity of PHP comparison operators: https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fwww.php.net%2Fmanual%2Fen%2F...
Before this change (and since PHP 8 compatibility is not here yet in popular libraries, you can say it is still the case), you would struggle with BASIC things like checking for an empty string:
if ($s == '') // WRONG, if someone passes 0, it will evaluate to true, yet result in non-empty string
if ($s === '') // WRONG, if someone passes false or null, it will evaluate to false yet result in empty string
if (!$s) // WRONG, if someone passes "0" or 0, it will evaluate to true yet result in non-empty string
if ((string) $s == '') // CORRECT (though it could probably result in an error in a number of cases, good by me)
That's what we're fixing in 2020/2021. In the decades, it's a language that brought absolute wonders like magic quotes, which would any mangle any input string with C-style escapes, in the false belief that this protected you from SQL injections. SQL injections resulted from this, yet it also brought the joy of web sites in which passwords containing " or ' or \ would not work, because they would be “escaped”, and your password would differ from what you actually typed.
Mind you, when that was happening, the default MySQL library didn't even contain the ability to pass parameters to queries. And when parameters were added with MySQLi, it happened with an over-engineered complicated system that totally discourages you from using it. Now, to add query parameters, you individually bind each of your query parameters to a variable, which it now references, and can set to whatever value you want. That's powerful, but complicates code for passing simple parameters, thus discouraging people from doing so, and still writing vulnerable code. To this day.
And if you're going to say that these are things of the distant past, think again. MySQL has been fixed, but shell commands still haven't been - on POSIX, there's no way to safely run a command composed out of execl() arguments, it always goes through the shell. Not only that invoked shell vulnerabilities like shellshock in the past, it means you have to carefully escape every argument, individually, with escapeshellarg(), which breaks badly on different locales, and is still prone to the programmer forgetting an argument, as with SQL queries without parameters.
To make it all harder, changes brought to fix these gaping holes of the language have been done in ways that would be disruptive to existing code, and done so often, all the while support for earlier releases have been made short. In other words, we break your code, and break it often. When magic quotes was removed, so was the ability to turn it off, making attempts to do so a fatal error, and complicating the upgrade between two versions that both lack the stupid thing.
Or, along with wanted fixes to the comparison operators, PHP 8 decided to make the signatures of methods during inheritance mandatory. Now, that technically makes sense, but in a language where you can dynamically take and pass the arguments, the new PHP version rejects code that does so with a fatal error, thereby breaking scripts that are correct. It's probably still the correct change, but add that to the fixes for outstanding issues that are also breaking, you're looking at a never-ending stream of breaking changes. And all code needs to be updated within a couple of years, because support for the PHP versions without the breakage is dropped fast. It's better than the Python 2 to 3 transition, which was one big pain in the ass, but at least that one you could put behind you. The PHP breakage is an ongoing process, and I have no confirmation it is done yet.
And let's not forget that the majority of GNU/Linux malware happens on PHP installations. And while the bad security of PHP scripts is not a fault of the language (except when it is, see above), and while the tendency of PHP users to download outdated unauthorized copies of commercial software even less so, PHP has become nesting grounds for malware. That's on top of the database leaks in which it has been complicit.