If you're serving sites for multiple different users (eg shared hosting) you can't safely use mod_php as all of the php would end up running under the same uid.

I bet there are still tens of thousands of otherwise secure php-cgi setups out there.