Back when it was new, and we used Perl CGI for everything, it was genuinely a security improvement, even though it had its own issues (often). The main trouble was that people didn't know how to sandbox it. I ran PHP-CGI for a number of years standard before php-fpm made sandboxing easier.