If an attacker has write access to your configuration files, isn't all lost already?
Any more so than the rest of your code?
Config files are typically written updated by non-developers and often go through a less rigorous release process, so having a less-complex and dangerous, even if less-capable, language can be desirable.
Ah, that's not been my experience - but I can understand that if non-developers are the ones making the changes