in reply to Configuring default @INC

"It seems like a security risk to me ... Yet I can't find anyone else having this issue because ..."

Because it is not an issue.

"When building perl (I'm actually installing with plenv) ..."

And this is your mistake. Use perlbrew.