Because they had the safe versions of their functions, I thought that they protected against things like that... but it appears not.

Safe can in theory protect against some attack vectors. But IMHO the major issue with that module is that its protection depends on blocking/allowing specific opcodes, which can change depending on Perl version, and AFAIK even which opcodes do what can change across Perl versions. So it requires deep knowledge of the internals, and even then it can't promise complete safety. Even though being able to eval Perl code "really safely" would be a nice thing to have, I would always strongly recommend against relying on Safe...