I'm just surprised with all the power TT2 offers through various config options that this can't be done
TT2 doesn't semantically interpret your template text as HTML — it just fills in the template according to the template directives [% ... %] etc. In other words, it doesn't "know" that the text src="images/logo.jpg" is an URI path of an image, so how should it selectively modify those parts of the template?
All you could do is interpolate a TT2 variable like src="[% images %]/logo.jpg" (as you've already figured)... but as you don't want to have the [% images %] hardcoded in the templates, there's little TT2 can do to help...
So, either do the path mapping via the webserver configuration, or simply use absolute paths as already suggested, in which case it doesn't matter that your CGI script has the additional cgi-bin path component in its URI.