> Requiring a browser implies that the device has a full web stack on it, including one of Perl, PHP, or Node.js.

Not really, CGI can be written in anything, shell scripting, C, whatever. But security-wise, it doesn't much matter the language because the programmers working on the web interfaces of such embedded devices rarely do a good job.