You could start the short lived Javascript scripts via a dozen other ways, but not PHP shell. Unfortunately for the world Matt Mullenweg and Mike Little decided to use PHP to write Wordpress so bots are constantly looking for idiots dumb enough to install Wordpress. If we enable popen(), exec(), shell_exec() etc in PHP it will just make it even easier for hackers to send spam and set up phishing sites on our servers.