A call to $this->logger->info() inside an entity looks harmless. It is one line, it does not change any state, and everybody agrees that logging is useful. Yet from that line on, your domain imports a technical interface, your unit tests need a mock to instantiate the entity, and the layer that is supposed to depend on nothing already depends on something.
A domain event describes something that already happened. It is a fact, not an intention. Yet many codebases publish events from inside the entity, at the moment its state changes, which couples the entity to infrastructure and lets you announce a fact before it is even true in the database.
Most architecture discussions treat the bus question as global. Either the whole application routes commands and queries through a CQRS bus, or none of it does. That framing forces a bad trade: pay CQRS boilerplate on a homepage that displays a greeting, or drop the bus on a module that genuinely needs events and transactions. The real unit of decision is not the application. It is the module.
A generic InvalidArgumentException tells you nothing about the business. It says an argument was wrong, but not which rule was broken or in what context. By the time you read it in a log, you are reverse-engineering intent from a stack trace.
Most PHP code treats password hashing as an algorithm choice. You write password_hash($password, PASSWORD_BCRYPT) directly in your authentication code and you move on. It works until the day the recommendation changes, and by then the algorithm you picked is hardcoded in every place that touches a password.