Answer
Risks: a broad blast radius (a bad parent change affects many apps), accidental pruning cascading deletes, and manually maintaining child manifests. Mitigate with careful prune settings and finalizers, PR review on the parent repo, splitting into scoped roots per domain, and using Projects to constrain what children can deploy.
Real-world example The team splits one giant root into per-domain roots and disables prune on critical children to limit blast radius.