The 5.18 fix would have been backported some, certainly to 5.16: I should have said "if you are running a perl much earlier than 5.18". I do know it wasn't ported as far as 5.8, which my $work was running at the time - I had to make the patch for that myself, and then come up with a plan to deploy it for a company that had had so many problems with a previous 5.6 -> 5.8 upgrade they had pretty much resolved never to upgrade again.

Happily, the eventual result was that they actually started upgrading perl more regularly again.

In the past I've worked for hosts small and large. They didn't upgrade anything, unless an OS upgrade occurred. A lot of 'low cost' hosts are like this, sadly. While 5.16.3 may have a backport for CVE-2013-1667, I doubt it caters for all the others.