Is configuring Database mail considered as a security threat?
In a vacuum, any activated feature is an additional attack vector (or, additional "surface area" for the system). That said, I've never read or heard of any attack or exploit using DB Mail.