Why would you avoid using this function?
Many programmers would pick their reasons to avoid using "switch" statements, depending on the context.
For instance, a project might have many "switch" statements with duplicated code to do something that would be solved with polymorphism.
The "switch", in this case, is being used to map HTTP methods with callables (except the "default"): you could map http methods to callables that could be replaced in runtime. Python programmers who follow the "pythonic philosophy" use dictionaries to do the same thing that "switch" statements do, but with the ability to change the map in runtime.
Is there a vulnerability in using the switch statement itself, or is it the $_SERVER variable that makes it vulnerable?
No, there aren't vulnerabilities in using "switch" by itself.
You should not thrust the values from $_SERVER because they're input from web clients (usually browsers). A simple "curl" script can send inaccurate or invalid data, such as the IP address, User-agent, the referer, etc. This is useful for web scraping (some websites are implemented to prevent naive scraping).
Check the "filter_input" function to filter values from global variables with input values ($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV).
An answer in this post (Is $_SERVER['QUERY_STRING'] safe from XSS?) recommends the use of htmlentities to protect $_SERVER values. Is this sufficient?