Yes, it is a security issue.
- read cookies (eg to steal sessions)
- read user input (eg to read password inputs)
- change what the user sees (eg to display ads, phishing, defacing)
- execute forms as the user (eg to change the users information, to send out spam to other users)
- perform requests to other servers (eg to send the obtained information to the attackers server, to perform DOS/bruteforce attacks on other servers, etc)
- you trust the domain / company from which you include not to harm you
- you trust them to keep their server secure
- you use HTTPS for the include to avoid man in the middle attacks
- the load on your server will be reduces
- the user might already have that file cached, so the website will load faster for your users.