The Arduino environment does not direct developers towards sound software engineering practices, and instead tries to hide some of the complexity by using its own preprocessor. The code itself is C++, or C when using SDCC instead of GCC, for example for CH55x microcontrollers.
The same approach to PHP scripting for web pages and services lead to infamous
Magic Quotes. Their purpose was to pre-escape inputs from web forms, so that if the programmer neglected to properly sanitize their inputs, it should lessen problems interfacing to databases. Some still look back at them fondly, and think it was a good idea, but it definitely was unsound engineering. You don't hide security sensitive details from the developers by heuristically trying to do it for them, you educate the developers; or you deal with the insecure mess you helped create.
Just like with PHP, that does not mean one cannot do useful and good stuff in the Arduino environment. It's just that the environment won't help with that, and may occasionally hinder you with it (Arduino's custom preprocessor). PlatformIO is more configurable, so you trade the ease of configuration in Arduino environment, for a perfectly neutral development environment using standard toolchains.
What this means for each developer, varies a lot. I know of pretty good code written in/for the Arduino environment, but many libraries are crappily written. One of my favourite good examples are the
Teensy cores used in PJRC's Teensy microcontrollers. They're pretty solid, and make development fast, because of the easy integration to the Arduino IDE.
Typical problems you see are library conflicts (two libraries don't work when both are used, even though either one works fine when used alone), plain bugs (especially when using the library even slightly differently than the author did), and missing implementations. MCU registers might not be set up properly, simply because the default values work for the original use case for the library. An example is the PWM frequency on some common AVR: as the same timer is used for multiple purposes, including millisecond and PWM generation, changing the PWM frequency means you need to modify the core for that board (or create your own variant of the original core).
Thus, as usual, it is a balance of things. The important bit is all of it being open source, so if you know or learn
how, you can always adjust it or create your own work flow and use your own toolchains. That also means that whatever you intend to use, you need to check, so learning how to determine if code looks acceptable or problematic is a necessary skill. Personally, I also recommend understanding the legal requirements of various licenses, and what they entail in practice. If you can afford it, hire a copyright licensing lawyer to explain the main ones to you, although you can find pretty good understandable explanations at various FOSS/OSHW-related organizations' websites too if you cannot/don't want to.