It only includes sites where the server-side language can be detected. That’s often easy with PHP because of URLs ending in .php and well-known software like Wordpress which identifies itself in ways that are easy for a crawler to detect.

So there are possibly more PHP sites out there than we realize, because the ones which disguise their URLs are ambiguous

It counts sites, not traffic. There are a lot of Wordpress sites out there which get three visitors a month.

You shouldn’t be as concerned with popularity, and much more concerned with attack surface. Your argument certainly can’t be that there are thousands of idle servers out there that should no longer be maintained because no one reads the blog hosted on them?