No, you're thinking of @EXPORT. Names in @EXPORT_OK are exported only if asked for, by convention.

CGI uses its own custom import routine instead of subclassing Exporter, but as far as I know it follows the perl conventions on this.

If sub1() is in @EXPORT, then it is indeed imported to the namespace where use CGI; appears. In that case, the last-defined version is the one which is called (along with a redefinition warning).

use CGI;
sub sub1 {} # this one overwrites CGI's
[download]

but,

sub sub1 {}
use CGI;    # CGI's overwrites yours
[download]