Well, if the PHP site gives you full control over the domain, then you have full control over the domain, don't you?

The security issue there is not the fact that MitM becomes slightly easier, it's that you can alter the site for all visitors and don't need MitM.