In such an environment my suexec'd FastCGI backend can't muck with your suexec'd FastCGI backend.

Okay, if ISPs normally run their FastCGI stuff with suexec then I agree it is more secure in a shared environment.

And I wasn't talking about modifying global configuration, I was talking about modifying code.

If you run separate suexec interpreters for each user, FastCGI prevents this. If you aren't running suexec, a common configuration for things like Mason is to send all requests through the same FastCGI backend.