Nor do I understand the security implications of installing it like this

The difference between the approaches is:

1. You are downloading a program from the internet and executing it in Perl.
2. You are downloading a program from the internet and executing it in Perl.

In both cases, you are trusting someone to not to anything evil. The main difference is that in the first case. there might be a slightly lower chance of accidentaly executing insecure code. The cpan client loads the software (which may or may not be secure) from a known server. The second approach brings the slightly higher risk that someone is running a fake website (type domain + paying for google ads) to bypass the original author.