@harrysintonen@infosec.exchange my old sysadmin was terrified of this specific problem so years and years ago we amended our php.ini, added a directory to the include_path outside of the website root and agreed that all functional code would live there and only presentation/formatting code would live in the website root.

It was a really solid system but it's made it a real bitch to look for outside hosting to migrate to now that my current sysadmin just doesn't /want/ to maintain a web server anymore.