The fact that a subset of systems are in a less vulnerable configuration doesn't have any bearing on the CVSS score.

> Specific configurations should not impact any attribute contributing to the CVSS Base metric assessment , i.e., if a specific configuration is required for an attack to succeed, the vulnerable system should be assessed assuming it is in that configuration. [1]

For a vulnerability to score a 10 its Attack Complexity must be 'Low' (broadly speaking: it doesn't require target-specific customizations or mitigations [1]), which isn't the case with php2shell.

Here's a breakdown of that 9.2: https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H...

[1] https://www.first.org/cvss/v4.0/specification-document#Attac...