The question you're effectively asking is what are the dangers of allowing every file on my server to be readable by anyone?
This has a few serious implications, the attacker could:
- View stored passwords - if, for example, you run wordpress the attacker could easily gain access to your username and password for your database server (e.g. wp-config.php)
- Gain information that could be used in further attacks - /etc/passwd may only contain usernames but that could be enough to start a brute force attack. Log files could also be read giving addresses of the user. Encrypted password files could be bruteforced offline.
- Read private information - if your website consists intellectual property (i.e. source code, e-mails) this could be easily read by the attacker.
Basically whilst your attacker hasn't technically gained root access they have gained access to a wealth of data. This data could either be used in other attacks or (depending upon the aims of the attacker) could be enough.
There are almost certainly situations there where this vulnerability would be as bad as the attacker gaining root access. The security priority for a server may be for it to not reveal the system's source code, if this vulnerability were present then for those cases the worst possible attack has occurred.