And having Perl cover your a** takes only one extra char!

No, that's a myth. Sure, it takes one (or rather two) characters to turn on taint checking. But turning on -T doesn't mean Perl validates data for you! You still need to write the validating code (and detaining) code. And that takes more than one character.