I guess the general answer is that everything is out because they have a lot of Perl already and not a lot of developers so why waste that time rewriting everything?

Having said that I wrote a bunch of Tcl last year for a speech[1] and the Tcl community is nowadays very small. It was hard to find answers to some questions online: the active period of the community predated Stackoverflow so there's not much on SO. And the library support is very thin compared to the giant Perl/Python/Javascript/... communities. None of these things are reasons why Tcl is bad - I happen to like it and my talk was a success partly because of Tcl - but it may be a problem for OpenBSD to adopt it.

[1] https://www.youtube.com/watch?v=9E5A608xJG0

I meant specifically about security. Because everything is a string?

I doubt it's much different than Perl. Both languages have very loose type systems. In fact the internal implementations are rather similar since both use strings but optimize numbers (IVs etc in Perl which are visible to the programmer, in Tcl the bytecode interpreter optimizes ints/floats to an internal representation but at the language level everything still looks like a string).

Perl's tainting feature is the only security-related advantage over Tcl that I can think of right now, but it's not used unless you explicitly enable it.

No, that doesn't make it any less secure security-wise. It's probably because Tcl isn't an ALGOL type of language. I love Tcl by the way and I wish it was used more than it is.

I'm also curious as to what the "security" issues are that TCL would be rendered "out".