This specification is not highly security-relevant, and it does not have any content in its Security Considerations.

In general, allowing file metadata, including size and ownership, to be desynchronized from the file contents, does carry significant security implications.  For example, understating the size of the file could lead to a buffer overflow in an incautious client.  If these considerations have already been addressed in another document, I think a specific citation to that text would be appropriate here.