Problem installing Drush 7 due to missing ext-pcntl PHP extension - any workarounds?
Are such security concerns justified?

Given the description on extension's introduction page, yes:


  Process Control support in PHP implements the Unix style of process creation, program execution, signal handling and process termination. Process Control should not be enabled within a web server environment and unexpected results may happen if any Process Control functions are used within a web server environment. 


Emphasis mine.

But also no, because, as greg_1_anderson stated in his answer, it can be enabled (or even compiled) into CLI only.

Then again, it might be yes. With functions like pcntl_fork it might be possible to make a fork bomb. Other bad things may also be possible. Personally, I wouldn't allow it on shared server.

Is there any workaround for installing Drush 7 without the ext-pcntl dependency?

Not really*, but if you can mount webserver's filesystem on your local machine and tunnel SQL port, you can install drush locally and still use it on remote website. From Drush's point of view there will be no difference.



* Correct me if I'm wrong here.