If you're using PHP exclusively, you shouldn't need the cgi-bin. Its only purpose is to segregate dangerous executables from the static code...but if no code is static, then hey!
Still, I keep all shared PHP code totally off-line, above the Documents dir (like /Library/WebServer/phplib). It just makes much more security sense.