It isn’t a security hole (the info page on why it is turned off literally says it is because people mistakenly believe is is a security hole)

But if you don’t have it on, software just falls back to STUN, which achieves the same exact result as upnp, just an order of magnitude slower and less reliably (though doesn’t require any router configuration or cooperation)