Net::FTPServer is written in Perl. Perl is inherently more robust than the C language which is commonly used to write FTP servers. Perl is not open to the usual stack smashing exploits, unlike C. In addition, everything sent by the client process is marked as tainted and cannot be passed to shell programs without special attention and treatment.
The server doesn't launch external programs to produce directory listings and so on.
For additional security, it is easy to configure the server to run as a special user and/or to run inside a chrooted environment.
The code is not derived from wu-ftpd and so does not inherit the security problems found in other wu-ftpd derived servers.
Net::FTPServer can be extended in two major ways: by adding personalities and by customizing the virtual filesystem.
By adding personalities you can change the way that the server works in deep ways: for example, changing the authentication mechanism, making the server anonymous-only or disabling and enabling commands.
By adding a new virtual filesystem layer you can make the FTP server serve files from a database, for example.
Net::FTPServer is highly configurable, either from the configuration file, or by writing extensions in Perl.
For example, you can limit every type of server operation using simple snippets of Perl inserted into the configuration file. Or you can make deep configuration changes by deriving a class from Net::FTPServer and adding your own code directly.