What are the potential security issues when importing an entity type?
Who would you expose this feature to?

If it's users with one of the permissions listed on http://drupal.org/security-advisory-policy then you shouldn't really worry about the security implications because those users can already do a lot of malicious things to the site.

I believe that all field names and field values should be filtered appropriately already and Drupal handles filtering on output, so I don't see a need for something like xss filter during import.

The fact that you want to use JSON instead of a PHP array as the method to represent the code seems great: copy/pasting PHP arrays around is an easy way to create an arbitrary code execution problem.

There is more discussion about safe ways to offer this feature in an issue in the Views queue.

If this doesn't answer your question please leave a comment and I'll do my best to expand.