Mocking a repository in tests does not verify your query; it only verifies that the method was called. Run a real database instead and the test suite slows to a crawl, so you run it less often. Either way, your filter logic ends up duplicated: once in the production code that hits the database, once in the mocks that bypass it. The two drift apart silently until a bug ships to production.
PHP does not have generics. A method that returns array gives no compile-time guarantee about what the array contains. PHPDoc annotations like @return array<Book> help static analysers, but they are invisible at runtime. A wrong element slips in, and the error surfaces far from the insertion point.
In most PHP projects, cache logic ends up scattered across business code. The handler that executes the query also contains the caching logic: key generation, lookup, storage, TTL. Two responsibilities, cache code and business code, coexist in the same method.
In most PHP projects, transaction management falls on the developer. But a forgotten DB::transaction() or a missing rollback, and the data sometimes ends up in an inconsistent state.