The 404 response is handled at the server level. Once your php file starts executing, the server's 404 handler is already disengaged.
Using header('HTTP/1.0 404 Not Found') is correct. Any bot or other client should be able to recognize that and treat it just as they would a server-supplied 404.
The 200 after completion of the php is normal.
You can also use readfile('your_default_404_page') if this is what you want.
header('HTTP/1.0 404 Not Found');