It is often a low-cost way to run a website because the hosting provider manages the operating system, web server and much of the software stack. Customers usually control their own domains and files through a panel rather than having administrator access.
This separation affects vulnerability response. A customer may be able to choose among installed PHP versions but may not be able to patch PHP-FPM or inspect the vendor's exact package build. Different accounts can also run different handlers on the same machine.
Good shared hosting limits the resources and permissions of individual accounts, but customer isolation does not remove the need for provider-side security updates. A vulnerable shared runtime may affect more than one website.
Ask the provider which PHP build serves your domain, whether the specific security advisory has been addressed and when the relevant workers were refreshed. Keep the application and its plugins updated within your own account.