Symlinks aren't necessarily bad.
First of all: If trying to open a symlink target, the file permissions of the target are in effect. If you're not allowed to read/write/execute the symlink target, nothing happens.
You might be able to run files outside your document root (sometimes that's actually what you want to do with them, right?). The problem can occur if your're not in a suEXEC environment and have an
www-data user on a shared hosting which, is in charge of serving files from different accounts. Your system user is not allowed to access files of another customer, but the
apache/www-data user will mostly have read rights on all the shared accounts. This might be a scenario where one user can access files of another user on a shared host. Not with your own user, but by accessing the file via browser with the
apache/www-data user. To sum up: In this scenario you will be able to access other users' files => bad.
The next bad thing is that an attacker could create symlinks, also to files like /etc/passwd,..., download this data and proceed with this information. This is not just only up to the symlink, but also up to a bad server configuration (where access to these files is strictly limited). So not using symlinks prevents from some more possible attacks.
It's not just about the symlink itself being a security risk, but a server configuration problem.