[gempir]

That's exactly what i was trying to say with the article :)

serving .php files directly is not security issue, but as you said nobody knows what's going on under the hood.