If someone tells you something is wrong, then they must be able to tell you why its wrong. And using relative links has no impact on SEO with any of the major search engines (at least for the last 10 years).
If someone infers from the presence of relative URLs in HTML that the service is vulnerable to path traversal attacks, then they are in the wrong job.
- in the normal course of events, these are converted to canonical paths in the client
- it is considered good practice from a development point of view to use relative paths such that an application can be deployed in a multi-tenant vhost and for code management
I am not saying that the application is not vulnerable - but there is nothing in the question to support this assertion.
While proving in a double-blind test that an application is not vulnerable to path traversal attacks, it should be trivial for a competent systems admin to deliberately conitrive a staged scenario (files with appropriate permissions in a known path outside the application path) to test.