A call to $this->logger->info() inside an entity looks harmless. It is one line, it does not change any state, and everybody agrees that logging is useful. Yet from that line on, your domain imports a technical interface, your unit tests need a mock to instantiate the entity, and the layer that is supposed to depend on nothing already depends on something.
Most PHP code treats password hashing as an algorithm choice. You write password_hash($password, PASSWORD_BCRYPT) directly in your authentication code and you move on. It works until the day the recommendation changes, and by then the algorithm you picked is hardcoded in every place that touches a password.
A controller reaches into middleware to run business logic. It looks convenient. The middleware has the session, the user, the request body, everything you need. So why bounce through a handler when you can just validate the cart right there? Because the moment you do, your business rule only runs inside an HTTP pipeline, and you just lost the ability to invoke it from anywhere else.
Hexagonal architecture promises adapter interchangeability, but in practice, this promise often remains implicit, with nothing in the code to verify it.