Well, the main question is in the title. Why in default Apache installation in Debian and Ubuntu the cgi-bin directory is in /usr/lib/cgi-bin not for example in /var/www/cgi-bin
Because that's what the relevant section of Debian Policy Manual requires. The Debian Policy document in general describes the policy requirements what each Debian Linux distribution and each package must conform to.