Craft 3 Database Backup
Craft uses MySQL's native mysqldump and PostgreSQL's pg_dump binaries to create database backups.

In order for PHP to be able to execute those binaries, it needs to be able to run the proc_open and proc_close PHP commands.

I would not consider it a security issue, but if you were really concerned about it, you can prevent Craft from making backups on update and/or specify your own backup logic bypassing Craft's default implementation.