I'd like to re-assure you that there are lots of companies out there that do solid code reviews and really know what they're doing, but there always seems to be some sloppy person out there.
A lot of developers feel that the code is the spec, but of course those developers write uncommented code, etc...

I think you have a chance in finding the type of company you're looking for, just don't move before finding one.
I'll send you a couple company names to avoid in Portland

Update:
What has been your experience?

Some developers welcome someone to look at their code, others feel it's a violation. I for one, have always seen benefit to a large project. I've also had to maintain code that had never been seen by anyone but the first developer.

Do you believe that developing Web sites means you can't have adequate specs?

Specs need to be flexible enough so that if time requirements out weigh features that you can modify the spec. However, they have to be clear enough so that the customer (being an outside customer or the marketdroids upstairs) can't come back with "improvements". If you're coming from a security view, you have to have solid specs. Adding features after the fact just opens loopholes.

Is your company averse to installing CPAN modules, even if they have been reviewed carefully?

Previous companies, CPAN was used whenever possible, but since I was the only Perl junkie in the department...

Do you have a job for a Portland, OR monk ;) Possibly While I feel that I am a generally solid programmer, I realize that I have a LOT to learn. I feel that I can better do that in a company that takes programming and security seriously, but I am seeing many examples where companies using Perl don't appear to be doing that. Will I be disappointed with most companies? Am I being conceited?

All programmers have a LOT to learn. And the smart companies will welcome having thier security holes patched.