The possibility to enable port forwards for any hosts inside the LAN has of course security implications. The problem from my point of view is not that there are bad users, but bad hosts/programs and of course the problem of CSRF.
But for some applications it would be good to have such a thing. Other possibilities like statically forward ports seems also less secure because then the port will be open all the time - also you have to maintain static IP addresses for all internal hosts, that should be reached.
The question is now: is it really necessary to have open ports for certain applications like btsync or some kind of instant messanger? Should a program depend on UPnP or is it possible to live without it? (bad question, i know - because in any case i have to live with bad security or bad application behaviour...)