Unlocking boot loader **doesn't** wipe data. How is it a security threat?
Using twrp decrypt password one can easily write a simple brute force script to guess your password. And as I can see it, there isn't any limit on how many times this command can be executed, so depending on the strength of your password, your device will be unlocked one day or the other. 

Having debugging turned off doesn't make any difference in TWRP