Whereas the lvalue variant returns '' (null string).

No. You're looking at the return value of the scalar assignment, not the return value of the lvalue substring. The lvalue substring returns the substring to be replaced as if it wasn't lvalue, but with some magic added.

You seem to think substr($x,0,1) = '' is one op, but it's two.

>perl -MO=Concise -e"substr($x,0,1)=''"
9  <@> leave[1 ref] vKP/REFC ->(end)
1     <0> enter ->2
2     <;> nextstate(main 1 -e:1) v ->3
8     <2> sassign vKS/2 ->9                  <---
3        <$> const[PV ""] s ->4
7        <@> substr[t3] sKRM*/3 ->8          <---
-           <0> ex-pushmark s ->4
-           <1> ex-rv2sv sKRM*/1 ->5
4              <#> gvsv[*x] s ->5
5           <$> const[IV 0] s ->6
6           <$> const[IV 1] s ->7
-e syntax OK
[download]

This allows more complicated expressions like

substr($x,0,1) =~ s/(.)/uc $1/e;
[download]

So no, there's no bug.