It runs the cgi script as your userid, not as some server-defined userid. Assuming you are an ordinary user, this reduces the risk of damaging the system, while increasing the risk of mucking-up your own files. Also, the fact that it runs as you means that if you do something dumb or nasty with it, the administrators have a better chance of determining who is responsible. It does some security checking for common holes. For instance, it checks that the owner of the directory where the script is found also owns the script.
Nothing is bulletproof.
The simple act of letting users create static html documents is itself something of a risk. He was covered with clanking chains of code.