So where are the real world exploits? Wouldn’t we hear of lots of barely maintained php servers being cracked open everywhere?

This is increasingly a story similar to the boy that cried wolf… next time people will not take such CVEs serious anymore.

Sadly they mean free as in gratis for the most part (other than Blender and Krita).

I have the feeling you only read the first and last few sentences of the article, or maybe used an LLM to give you a false summary?

There are people willing to donate their time* so only funding the hardware and other unavoidable running costs is often fine. If you find it too much workload, try looking for other volunteers.

*because contrary of what some economist think, it is often more enjoyable to work on something that isn’t paid, then to use the same time to work for money and pay for the service. You see the same effect with the people that prefer selfhosting as you say.