register_globals could not have existed without the legality of undeclared variables, and it could not have been a security issue without code that relied on using undefinedness as a default value.
of course it could be a security issue without undefined variables coercing to an empty string in string context - it could allow request parameters to override defined variables.