Bash is still executed even with the multi-argument call to system.
The file /usr/bin/xzgrep is a shell script (note the #!/usr/bin/bash as the first line of the file). It inherits the CGI environment variables from its parent process, in this case the Perl interpreter. And since some of those CGI environment variables are controlled by the attacker (such as the Referrer: and Cookie: headers) the arbitrary code is executed.
And Bash is even executed when you open(INFILE, "/usr/bin/xzgrep error /var/log/my.log|","r") -- because the thing you're running isn't an ELF executable, it's a #!/usr/bin/bash text file.
Yes, there are other ways to do this (call xz directly without the xzgrep wrapper, use IO::Compress::xz, etc).