[NOTE: After a little more testing, I have just updated these instructions (plus including them in the issue . If you have already applied them, please be sure to re-run the apt lines from the "fix" below.]

I was sort of right... So it appears that whilst the sury.org PHP repo is enabled, by default no packages should be installed from it. And the sury.org repo isn't included in the sec updates. So I'm not completely clear how you managed to end up with them actually installed (unless perhaps you were upgrading from a v15.x appliance?). Regardless, it should be fairly straight forward to resolve. To remove any errant sury.og PHP packages, and ensure that only Debian ones are installed, try this:

# disable the 3rd party sury.org repo (and pinning)
mv /etc/apt/sources.list.d/php.list /etc/apt/sources.list.d/php.list.disabled
mv /etc/apt/preferences.d/php-sury.pref /etc/apt/preferences.d/php-sury.pref.disabled

# clean the apt cache
apt clean

# pull latest updates
apt update

# purge all php7.2 pkgs explicitly
apt purge -y php7.2*

# force re-install (possibly downgrade) of a few specific pkgs (php & deps):
apt install --reinstall -y php-igbinary=3.0.0-1 php-imagick=3.4.3-4.1 php-redis=4.2.0-1 \
    php-pear=1:1.10.6+submodules+notgz-1.1+deb10u1 libpcre3=2:8.39-12 libzip4=1.5.1-4

# reinstall all desired php packages (to ensure that you have the right ones...)
apt install -y --reinstall php-mysql php-cli php-gd php-curl php-json php-intl php-xml php-mbstring \
    php-zip php-pear php-imagick php-igbinary php-redis php-ldap php-imap php-gmp libapache2-mod-php

Now if you restart Apache, all should be well:

systemctl restart apache2

Hopefully that fixes it. Let me know how you go...