Why should the Hacked! module not be used on a production server?
A quote from the developer of the module, in response to exactly the same question:


  The module is aimed at developers wanting to know what other developers got up to, not to detect if someone broke into your webserver and changed some code.


As such it doesn't really belong on a production server; it doesn't appear to be a security risk (although it does download to your local files folder), it's just not what the module was designed for. 

There's also another comment on that post that sums it up nicely:


  It's not that it's fragile, unstable or (very) dangerous.
  It's just that "You're doing it wrong" if a production site is where you actively use the features provided by "hacked".