Forking a process per request is expensive, interpreter or not.
Slashdot used apache mod_perl back then. It never forked a process per request.
Slashdot started in 1997, the first release of mod_perl was on 12.03.1998. They certainly used cgi at first, just check the url here: https://web.archive.org/web/19980113191337/http://slashdot.o... - it says cgi right there.
Edit: Seems I was wrong about the date, it was actually 28-Jul-1997[1], nevertheless slashdot was only launched two months later, and as the link above witnesses didn't seem to have used it at first.
[1]: https://web.archive.org/web/19971210053529/http://perl.apach...
I'm not sure about the "chock full of potential security issues". You have to be careful with trusting environment variables as the Bash guys learned, but I don't know what else there is that is specific to CGI.