There are ways to have PHP scripts execute using the userid of the file containing the script. This makes PHP scripts as secure as CGI scripts, and it can solve the problem; however, it is places a large load on the web server and few web hosting providers do this.
Servers running cPanel have this built in (but not enabled by default):
"Php's open_basedir protection prevents users from opening files outside of their home directory with php."
I have seen the same thing done with an asp.net app on a windows server. The person opened a temporary shell, that executed any command under iis server permissions, then killed the shell after output. Showed me all sorts of neat information about the server including who administrated it.
This isn't just a php thing.
If you are on a shared hosting environment your data is not 100% safe at anytime. It is pretty simple for another user on that system to explore the server using a simple php script that acts like a command shell under the apache user.
If you have an account that requires the utmost security at all - charge them an arm and a leg and go for a dedicated server to run your accounts on.
From the outside it is up to the developer to not create exploitable scripts.