Not likely to be a major risk if you update every few months, to some major version that's already over a month old.
I would imagine it's the opposite. Most dev's machines can't query the prod database, for example, whereas a prod server can.
Nope, they've been targeting credentials so they can deploy whatever they like into prod. They prefer the build machine with it's broader rights than the individual dev boxes.