why not have a certain base function that sanitizes all of the arguments passed to the module, and then passes the newly sanitized arguments on to the function that was supposed to be called?

Because there is no universal "sanitizing" function. What's valid as a filename might not make sense for an email address, and vice versa. Every argument has to be considered individually, and therefore any wrapper would have to know what arguments are expected. By the time you've done all that, you might as well just subclass or edit the original subroutines, rather than wrap them.

That's why I hate these "untaint" modules: they generally are re-opening the hole that tainting is trying to close. Every value needs to be considered individually!