In order to use persistent storage, the application must request quota, which results in a prompt to the user. It could obviously be used as a supercookie at that point, but given that the user has been prompted, it seems to be a less concerning avenue than other areas. (Also, being Chrome specific would likely make it less targeted than other supercookie techniques.)
Temporary storage is not prompted, but the browser can clear it at any time. I'm not sure when this occurs, but I believe it should occur if you clear all local data.
I'm not aware of any specific security concerns related to this API, since it provides a sandboxed filesystem to each origin. (It cannot read/write arbitrary data from other applications or locations on the user's computer.)
I consider this a privacy issue more so than a security issue -- in my mind, if the API is working as intended and does not leak/reveal data that was not in the original design, then it's a privacy decision that was made by the spec designers. (Obviously, many users are unhappy by many privacy decisions that have been made -- I'm not saying it's desirable.) It becomes a security concern when a privilege boundary is crossed or you can use it to reveal information that the designers did not intend. (Such as the implications of canvas fingerprinting.)