I didn't say Perl doesn't support Unicode. You're putting words in my mouth. Look closely at what I said.

Yes you did:

"Perl is not yet fully unicode compatible"

Quite the opposite. Perl has the best support for Unicode of any language I've seen. (That includes C, C#, Java, JS and Python.)

Is it true or is it not true that Perl is not using utf8 encodings natively?

It is one of two encodings it uses natively yes. It's an encoding specifically created for Perl after all. Not that has any relevance on the subject.

The very fact that one must tease Perl into using utf8

No, the fact that handles are byte handles by default does not mean that Perl doesn't support Unicode.

the very fact that its developers still see security risks in its use

...means nothing at all. That has nothing to do with Perl at all. There are security issues all programmers that deal with UTF-8, UTF-16 and Unicode must be aware of. Nothing in the document you linked is specific to Perl at all.

For example, allowing https://sаfe.com/ to be displayed is such an issue, since that doesn't say "safe.com". (And that's why it shows up as https://xn--sfe-6cd.com/ in the URL bar of Firefox.)