[jtreminio]

register_globals was removed several years ago;

mysql_* functions all have a big red warning at the top of the docs pages warning users not to use it;

extract has a big red warning about using it on untrusted data.

PHP shouldn't hold developer's hands, but it does enough to warn them away from the Here There Be Dragons.

[meowface]

You're right about register_globals.

However, the others require users to actually read the documentation, which unfortunately many do not. A new user of PHP reading a tutorial does not necessarily know these functions are unsafe. They type the functions into their program and they still work, even on the latest versions of PHP. They don't see a visible deprecation warning on the page.