They're hurting their users because their users are probably not sophisticated enough to understand what the fact that they're using PHP means (and may not even be able to tell that they're using PHP at all). It means that there is a higher probability that the program will have a range of security bugs. It means that the programmer has to take extra care to avoid logical errors in a variety of contexts. It means that, overall, the software is going to be of worse quality than software with the equivalent amount of effort expended to create it in another, better language.