Are data gateways a security solution, and what do they mean for the perimeter?

Not by design. Their job is to connect business partners, so every one is another passage in the perimeter. If the vendor provides for it, they can implement control functions, but their many connections into backend systems and their legacy parts make them attractive targets, and the field is hard to secure.

What they do offer: because they check and convert formats, they have built-in control functions. How much real security checking that amounts to, for example whether they resist injection attacks (malicious data crafted to be executed or misinterpreted by the receiving system), has to be examined case by case. Gateways that communicate over public networks such as the internet must be handled especially restrictively.

Go deeper:

• Attack surface — Wikipedia — why every extra passage and legacy part enlarges what can be attacked.
• OWASP API Security Top 10 (2023) — the risks a published API brings, gateway or not.