because 'Perl has bindings into OS calls that bypass OS security'.
I would press him to prove that point. It sounds like he is on a weak OS (Windows :-) ), that uses "voluntary cooperation" to maintain security.
Maybe he is thinking of a "limited cgi runtime environment plugin" like Java has. I wish Perl could get a Browser plugin like Java's. That is about the only disadvantage that Perl has. I'm seeing alot of pages with dynamic graphing apps, using the Java Browser Plugin. Then again, a combination of a perl cgi and flash animation is about as good as Java's plugin.