This would break quite a lot of existing code, though PHP could add an explicit keyword like "inout" that catches this behaviour (see example in Hack: https://docs.hhvm.com/hack/functions/inout-parameters).
Today these issues can also be caught with static analysis: https://psalm.dev/r/1f670956ab
