I remember performance being the main reason people jumped ship from CGI in the period 01995–02002. The switch didn't solve security problems itself (except Shellshock, if you wrote CGI scripts in bash, but Shellshock wasn't publicly known until much later) but it sometimes came with a less slapdash approach to building web services which did solve security problems. On the other hand, it often instead came with a move to PHP, which had just unbelievable levels of security problems.

It's possible that your experience with people switching was later, when performance was no longer such a pressing concern.

The main security issue I recall from CGI was caused by the web server having to execute the binary. This meant either executing as www-data, running the web server as root so it can call setuid, or using setuid binaries which have their own issues.

These were real issues on multi-user hosts, but as most of the time we don’t use shared hosting like that anymore it’s not an issue.

There were also some problems with libraries parsing the environment variables with the request data wrong, but that’s no different from a badly implemented http stack these days. I vaguely recall some issues with excessively log requests overflowing environment variables, but I can’t remember if that was a security problem or DoS.

I remember megatons of Java Servlet(tm) hype convincing us that real programmers do OO.

Java remains the only programming language I've ever heard covered in a feature story for NPR.