and well-known software like Wordpress

Sorry, but you're using the fact that PHP is used by the framework that makes up about 40% of the web on its own as an argument against the claim that PHP might be on as much as 70% of all websites? That's before you start getting into other platforms like Drupal and MediaWiki, or more general-purpose frameworks like Laravel.

It only includes sites where the server-side language can be detected. That's often easy with PHP because of URLs ending in .php and well-known software like Wordpress which identifies itself in ways that are easy for a crawler to detect.

So there are possibly more PHP sites out there than we realize, because the ones which disguise their URLs are ambiguous

It counts sites, not traffic. There are a lot of Wordpress sites out there which get three visitors a month.

You shouldn’t be as concerned with popularity, and much more concerned with attack surface. Your argument certainly can’t be that there are thousands of idle servers out there that should no longer be maintained because no one reads the blog hosted on them?

Wordpress is still commonly used for e-commerce. You’re probably visiting more PHP sites than you realize.

A large installed base of web apps including giants like Wordpress combined with a desire not to migrate when something is working.

Are you actually though? Because if you were actually wondering this, it wouldn't take a genius to figure out that you can very easily stop wondering by googling something along the lines of "what websites were downed on account of the recent php vulnerability". But you clearly haven't. So why the fuck are you even in this conversation?