Runlevels determine what services are started on Unix machines. Usually the higher the level, the more distinct processes are executed. As a general rule level 3 does not include GUI and level 5 does.
There is no right or wrong runlevel. It's about compliance.
The problem might arise when you secure your server assuming it's running without a graphical environment (thus for example you don't harden or patch it), but in reality it does (so the attack surface is larger than you assumed).
The checks are there to make sure the machine is running at the level you expect it to run; and that it runs (only) services you expect it to run at the specified level.
And which level could be undesirable?
Any level different from the policy specified for each individual server is undesirable.
What can go wrong if I configure the runlevel wrong?
In such case you cannot claim you have a full control over your systems. You don't know what processes they are running, you can't tell if those processes are secure. You can't tell what can go wrong.