From a security perspective, that's just as bad. Someone with write access to the config file could change it to:

system("insert malicious command here");
{
    username => 'zxcvb',
    password => 'zzzzz',
}
[download]

If you don't need to trust the keeper of the config file to refrain from malicious or even dumb stuff, why expose yourself to the risk.

Check out YAML for another way to represent complex data structures in config files without needing eval (or "do" in this case).