From the programmer's perspective:
When you use unlink, you expect to delete a file (user supplied or otherwise).
When you use <>, you expect to read a file (user supplied or otherwise), but it doesn't.

From the user's perspective:
When asked for the name of a file to delete, you're not surprised if the file you specified gets deleted.
When providing the name of a file to read (script.pl *), you're *are* surprised if the file name gets treated as a shell command.

The problem is the divergence between the programmer's needs and the tools provided by the language. <> is the closest thing provided to what the programmer needs, so it gets used. The alternatives are just too costly in almost all circumstances.