Security implications of running SSRS and an OLTP database on the same server
The Moment you add Entry points for a system of course, naturally, you have increased the attack surface.
Besides this purely mathematical reason, you should think about:


Who will design reports
For designing reports someone, maybe the same person, will craft queries
Preferably you use stored procedures at least inside a separate, code-only, database
There you have the first permissions you will have to give inside your system for selecting data and creating objects. If done with care the risk is extremely low to zero. So keep it simple.
Above that on the server level you have the Reporting Services Service. Here you are strongly advised to keep to established security best practices such an “use dedicated service accounts”, especially since SSRS has a Login on the SQL Server box for accessing its system databases. Again, no problem if you isolate all that.
And then you of course have the Data Source Credentials which will be a Windows or even SQL Login with just the permissions necessary for running the above queries – at best only prepared stored procedures for mitigating the risk of elevating privileges.


So, long story quick answer: mixing services initially creates a higher risk for taking over the other one, but by following security best practices very strictly, in my opinion, the risk is not higher than if on a separate server where one could still make similar mistakes. In high security environments there will for that very reason be very strict overall rules to rule out such scenarios.