why would simply executing it be a security vulnerability?
base64_decode does exactly what you would expect: It decodes a string.
There are also no know vulnerabilities in it, nor have there been in the past (there was an integer overflow issue in
base64_encode - CVE-2003-0861 - but PHP does not consider it a security issue).
I would assume that http://phptester.net/ bans it because it can be used to obfuscate data. They may have some filters in place to prevent execution of dangerous code and may worry that
base64_decode could be used to bypassed these filters. I don't think that this is necessary or useful, but that might be their train of thought.