What security risks does the Test Access Port (TAP) introduce?
Yes, TAP introduces hardware security risks. If you have access to the JTAG port you may be able to introduce false input/output.  However many chips provide a JTAG disable configuration that disables the JTAG after programming.

As far as risk mitigation, if you need such low level physical security you might consider choosing an IC that doesn't have this feature, or allows you to disable it.  Some disable signals are only a flash bit, and a full chip erase can restore JTAG access, others permanently alter the IC so JTAG will not be available after disabling it.

There are also implementations of encrypted JTAG, where you cannot use JTAG without the proper encryption and keys.

The 2009 paper, "Attacks and Defenses for JTAG" provides significantly greater detail in the various means and ways that JTAG can be attacked, and defenses available.