Is having the
WP_DEBUG_LOG enabled, and having a
debug.log in a production environment a security issue?
I would consider it a security concern if everyone is able to view the
debug.log file from the browser.
It could reveal e.g. paths, plugins and their problems.
There are though ways to restrict access to it via Nginx or Apache.
Another problem I've seen with logging to
debug.log on production sites is that it's not auto log-rotated, so it can grow fast for busy problematic sites. It's easy to forget about it there, until the disk is full or the huge size starts to slow things down.
ps: I just remembered I wrote something about access restrictions here.