I like all your points but-

Since CPAN is a horde of people you don't control, you can save yourself a lot of work, but you also take on a lot of risk (which is not an absolute definition).

I say the risk is approximately zero unless your general planning/design skills are totally haphazard.

You downloaded the code, it's done. The only "risk" is that the author will take it an unwanted direction or something. You don't have to upgrade and you can fork the module or abandon it for your own new implementation with the same API so your other code won't have to change. Either way, you've lost nothing because you would have written/owned it otherwise to start with.