The version string helps identify language features, compatibility and which upstream branch a runtime belongs to. Tools such as php -v and phpinfo() can display it, although they may be inspecting different PHP installations.
For vulnerability response, it is a useful clue rather than complete evidence. Linux distributions and hosting providers may apply a security backport without changing the upstream PHP version embedded in the binary. The package release suffix, vendor advisory and changelog may carry the proof of the fix.
The opposite problem also happens: a shell can report a new PHP version while the website still runs an old PHP-FPM service. Multiple runtimes and containers make that mismatch easy to overlook.
Read version strings together with the provider's packaging information. Always confirm which runtime handles the affected workload, and avoid calling a system vulnerable or fixed on the version label alone.