In a specific Paillier implementation, why is r prime?
Is there any risk in changing the implementation to make $r$ random but not necessarily prime?


None [1].  Consider the case where you encrypt two values, forming the ciphertexts $g^m r^n$ and $g^{m'} {r'}^n$, and then you homomophically add them (by multiplying the two ciphertexts).

That results in the ciphertext $g^{m + m'} (r \cdot r')^n$.

As a result, $r \cdot r'$ may not be prime [2]; if this were a security risk, that means that you really couldn't use homomorphic addition (or, actually, Paillier at all, as an attacker could take your ciphertext, add an encrypted 0, and generate another ciphertext that encrypts the same plaintext, but with a likely composite $r$).

Hence, there is no drawback for choosing a composite $r$



[1]: Other than the risk inherent with modifying any cryptosoftware and accidentally breaking something you didn't intend...

[2]: Actually, it might happen to be, as it's actually $r \cdot r' \bmod n$, and that value just might happen to be a prime within $\mathbb{Z}$