* Security: as described above
* Efficiency: the method used for Safari requires more server resources
* Performance: the method used for Safari is slower
What is the reason that seems obvious to you?
The reason he's thinking of is that they want to annoy people into enabling 3rd party cookies for tracking purposes, with security/performance/etc. as the excuse.
Go to settings, check "block 3rd party cookies"
scroll down to customized behaviors, click "Add" next to "sites that can always use cookies"
Enter the domain you want. Before saving, make sure to check "Including third-party cookies on this site".
--
Or, ya know, read the instructions in the link on this post telling you to do exactly this for drive.google.com :P
As for security, yeah, there are some good reasons for not embedding auth info in the link (tho one could still POST the same data instead without a third party cookie, etc), as well as for having a dedicated domain for user content.
In this case you are probably right, but surveillance is Google's business model.