Administrators use phpinfo() to find the version, Server API, loaded configuration file, environment and effective PHP settings for the process handling a request. Run through the website, it can answer questions that a shell's php -i does not, such as which FPM pool configuration is active.
The same detail can be sensitive. A phpinfo() page may display file paths, environment values, request headers and other information useful to an attacker. Depending on the environment, secrets or private operational data can appear in its output.
A diagnostic endpoint exposed to the public internet is therefore a security liability. It may also be cached by an intermediary or retained in screenshots and logs after operators believe they removed it.
Use restricted, short-lived diagnostics when necessary, collect only the fields needed, remove the page afterward and never publish full phpinfo() output as proof of patch status.