Nope. Both take just the good, but only one makes that explicit. In this case you assume (correctly or not) that "word" characters are safe. So you either extract the parts containing the word characters and concatenate them back together or you remove anything that's not a word character. Different implementation, same task.

Removing malicious characters would mean deciding that for your intended use the data should not contain a newline, a quote or a null character and doing something like

(my $good = $bad) =~ s/[\r\n'\x00]+//gs;
[download]

The difference is that instead of starting with a set of safe characters, you attempt to guess what are all the unsafe ones. You are much more likely to miss an unsafe character in this way.