The answer to that depends. Is your VM connected in a host only network? or a virtual subnet that is not connected to the internet? or is the vm also allowed to access the internet (i.e. bridged or nat)?
Having root access to a machine on your network with no password is a huge security risk. If it got exploited somehow, it would give an attacker carte blanche to download all kinds of penetration testing tools and network assessment software (think apt-get install nmap, mysql-client, etc...) and basically roam around your network as if they were sitting right next to you connected to your wifi.
If the vm is connected in host only or is in an isolated subnet then it basically is about as secure as your host os, given you haven't made some ridiculous misconfiguration somewhere. Since, the host would have to be exploited first. But personally, I wouldn't feel safe in this situation either. But then again, I'm the paranoid sort.
Setting up ssh keys isn't that much of a pain. It might take all of 5-10 minutes to accomplish. There are many guides on how to do it easily, like this one from Digital Ocean and, although I highly recommend against it, you can even make keypairs that require no password if you absolutely must. At least that way someone would require the ssh key to connect making it more difficult than just logging in.
But to answer your title question bluntly, if your development vm is connected to the internet with root access, no password and is available a good percentage of the time, the security implications are potentially complete and total compromise of your internal network. I'd really recommend against it.