It is common in shared-hosting environments where many customer accounts run on one server. CloudLinux features can limit how much CPU, memory or other resources one account consumes and can isolate accounts from one another.
CloudLinux also offers PHP Selector and alternative PHP packages in supported configurations. Some older PHP branches may receive vendor-maintained security backports even after the upstream PHP project has stopped releasing updates for those branches.
That distinction matters for vulnerability reports. A PHP version displayed in a panel may look old, but the exact CloudLinux package could contain a fix. The reverse is also possible if the relevant update was not installed or the domain still uses another PHP stream.
Check the configured PHP selector or handler, the source package and the CloudLinux advisory covering the specific flaw. Confirm that the affected site actually runs the intended patched build.