One thing is you can use $r->pnotes() to pass information from module to module (along the Apache request loop), so there's the possibility of customizing output based on the authorization phase, say, not to mention the ability in the first place to even intervene in the authorization phase. Also, you can cache some data for all requests to use (CGI programs are one-shot deals, so they have to be reloaded every request).