I've written security-sensitive web backends in PHP and Python (and even in plain C back around the turn of the century, back when we had to work around Internet Exploder not handling connection closure/keepalive sanely, with various bugs in browsers' MIME implementations, and so on), for servers known to be basically constantly under attack. I consider it doable (reliable, maintainable) even in PHP, if and only if I have full and exact control of the codebase.
Working on PHP or Python code, in a security-sensitive context, with someone else who has a different idea about security? Hell no. I can show how to maintain the codebase, by explaining the security model and how and why it works and what would break it, but that's just replacing me with someone who does the work like I would, and understands the model like I would.
That is also why I much prefer a hierarchical access controls based on filesystem access model: it allows delegating less sensitive parts to other developers, without opening up gaping security holes. Pity current webhotels cannot support such, because they're hardwired to the "one machine user and group, one site" model.