This could give rise to an information leakage vulnerability.
Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources.
For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique to that page.
With DNS prefetching enabled, a suitably places eavesdropper can infer that a user has a mortgage with that particular bank because when this page is visited DNS requests will be observed to resolve the external resource hosts referenced by that page.
Of course, if the user decides to visit those links manually, the same could be inferred without prefetching in this case. However, with more complex sites there may be unique combinations of resources on different pages giving away to observers which pages on the otherwise private session have been visited.
Whether this is an actual security vulnerability or not depends very much on the context of the website and the placement of links. Another mitigation instead of disabling would be to include all, or a random selection of, external references on every page using the
<link rel="dns-prefetch" href="//example.com" />