This is what quite a lot of people have been claiming in this thread thus far, and you're the last one in order, so I'm replying to you that I may well buy your argument; but then the OS should clearly say so, to the effect that the Perl installation should not be touched in any way

Which includes not shipping a CPAN.pm and a cpan script. Clearly you never need CPAN for a perl that's never used for anything else but for the the operating system itself.