It is not really a security risk, as it is only accessible to processes already running on the server. There are residual risks which are applicable to all mail delivery software:
- It is possible to send sufficient email to a user to use up their quota. This assumes you have quotas enabled, which is not the case on default install.
- Potential to cause code to run as a result of sending the mail. Exim has a good record for being a secure mail delivery system.
- Potential to cause Exim to raise the load average to cause slow performance.
On a default install, there are far simpler ways to directly cause the problems that could potentially be create via Exim.
Some tools expect to send email via SMTP rather than using the sendmail functionality built into Exim. Disabling the ports will still allow email to be sent using the sendmail method, so disabling the listener is unlikely to increase security.