Remove XMLRPC to avoid vulnerability exploit
is it safe to remove xmlrpc.php file?


Yes, if you're not expecting anyone to use it. 


  Is it bad practice? If so, why?


Could be construed as such; any change to core creates an additional step when updating (I'm sure we're all aware of the dangers of 'hacking core' by now, but if not: Never Hack Core).


  Is there any way to neutralize this security risk without removing this file?


Update your core to 7.31, where the vulnerability has been fixed.