We have PHPUnit required in composer.json, why not phan also? It's run on CI, so it should be readily available for devs to run before they request review. Why require devs to install it separately globally, and make sure their version matches the version on CI so that get useful results?
Because phan requires PHP >=7.0 (other dev deps require >=5.6.99) and until recently also required specific versions of php-ast, which would have make composer install really inconvenient for a lot of people.
I think we can reconsider this and implement it after core requires PHP >=7.0.