It has nothing to do with the substitution. The interpolation occurs before the assignment is even performed. You'd get a strict error has you been using use strict; as you should.

$ perl -wle'use strict; my $str2 = "@cce$$ag@!n"; print $str2;'
Global symbol "@cce" requires explicit package name at -e line 1.
Global symbol "$ag" requires explicit package name at -e line 1.
Execution of -e aborted due to compilation errors.

$ perl -wle'use strict; my $str2 = "\@cce\$\$ag\@!n"; print $str2;'
@cce$$ag@!n
[download]

Now that the variables contain what you want them to contain, you still need to convert $str1 and $abc1 into a regexp pattern. quotemeta can be used to do that.

my $str1_pat = quotemeta($str1);
$str1 =~ s/$str1_pat/$str2/;

  - or -

$str1 =~ s/\Q$str1\E/$str2/;   # Same thing.
[download]

But the fact that s/// is used at all is very fishy. s/// should be needed to change a password!