Is enabling cron jobs for Cpanel a security risk?

A cron job only schedules a particular script to run. It has nothing to do with access permissions.

If a person wanted to write a script to do X, it will do X whether they run it manually or via cron.

As a programmer, I used cron jobs a lot to help schedule tasks for particular clients, clean this out, mail a reminder, etc. It comes in pretty handy.

If you're that worried about it, you could always remove it from all accounts using your Feature Manager, then only add the option for those that request it, in a different feature list.