batchUpdate using pdo and MSSQL

When you attempt to UPDATE the "first" row of a result set without using an ORDER BY clause in the SELECT, there is no guarantee that you are actually affecting the latest entry. Is it safe to use LIMIT without ORDER BY

I don't personally have any experience with MSSQL yet, but I think you should definitely read and absorb the insights at Solutions for INSERT OR UPDATE on SQL Server to understand the options and concerns when doing an "upsert".

Using a transaction is probably better intentioned when you implement it within your insertOrUpdate() function.

Your function naming is way too vague to be helpful/searchable within your project. Without knowing more context, I might suggest batchSaveProductPermissions(). I also find $element to be an unhelpful name for what I am interpreting as a "row" that contains "permission details". Since you are only accessing the first two elements of the row, you can even try "array destucturing" syntax inside the foreach if you like.

I see individual variable assignments in your foreach loop, but several of those variables seem to be logically related/group-able since they relate to permission values. I might package the permissions and the directCallId as an associative array before passing it into insertOrUpdate(). This will reduce some horizontal bloat and simplify maintenance when you need to extend the permission options in the future. (Generalized Demo) You can use null coalescing to replace isset() ? : syntax. I recommend not juggling different names for the same data; align $DirectCallId with your database's reportId.

function batchSaveProductPermissions(PDO $pdo, array $products): void {
    $allPermissions = ['isPremium', 'isExclusive', 'isLimited', 'IsNew'];
    $defaultPermissions = array_fill_keys($allPermissions, 0);

    foreach ($products as $uid => [$permissions, $directCallId]) {
        $payload = array_fill_keys(
            array_intersect($allPermissions, $permissions),
            1
         )
         + $defaultPermissions
         + ['reportId' => $directCallId ?? false];    
        insertOrUpdate($pdo, $uid, $payload);
    }
}

Now your receiving function can begin like this:

function insertOrUpdate(PDO $pdo, int $uid, array $payload):void {

Then within your insertOrUpdate() function, you can leverage the beauty of the associative payload to avoid writing those vague :value# placeholders -- now you can use very clear placeholder names. You can even skip those bindParam() calls by directly feeding an associative array into the execute() calls. (Some minor manipulations to the arrays will be required depending on the query.)

To avoid get_date() in your INSERT queries, apply the DEFAULT value on insertion to be the current date and let your database handle this automatically.

As a general rule, I prefer to return the affected row count from UPDATE functions and return the insertId from INSERT functions. In this case, you will expect to affect, at most, one row, so I'd probably return the id of the inserted/affected row. I realize that your code isn't currently interested in this return value, but I find that it helps with debugging if this technique is already in place.

Finally, do not print errors from a querying function. You can throw and catch exceptions if you like, but avoid expressly printing from within the function body.