I guarantee that security guidelines were not involved in any decision about which version of PHP to use in a project. All PHP code is security tainted and needs protection at the underlying data service layer.
I would almost guarantee security guidelines were the reason. He states they are dealing with tax data, and I would bet they handle some credit card data as well. If they even touch credit card data they have to be PCI compliant (http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Secu...) which requires specific versions of PHP.
If it requires specific versions of PHP, I would hope that doesn't include a self-patched build that deliberately masks erroneous input data by treating NULL as 0
The moment you run a patched build, you're IMHO not running the officially sanctioned version any more.
