I don't think there is an additional security risk from running an arbitrary editor from
visudo strictly speaking. Clearly, the user running
visudo already has permissions to edit
/etc/sudoers, and therefore has the ability to add rules that will allow execution of any other commands on the system. So regardless of which editor is run, a user that can
visudo can already execute whatever they want indirectly by adding a new sudo rule.
I think the advisory in the documentation about the
VISUAL environment variables is about executing a root shell (or arbitrary command) while bypassing sudo's standard logging. By default, sudo logs all successful and unsuccessful authentications to syslog. This gives the system administrator an audit trail about which users are executing which commands through sudo. If a user changes
visudo, that can be seen by checksumming or reviewing the file. However, if a user can get a root shell through
visudo, they can execute arbitrary commands without any audit trail.
So the security risk is the same as granting permission to run
sudo bash, namely that a user with that privilege can get a root shell and execute arbitrary code without any restriction or logging of the commands that are run.