The way I look at it is: it's practically the same as when you're using development dependencies locally, they're not exposed publicly over the network, so I'm not sure what security risks you'd be worried about?