If you have secured access to the script sufficiently and made sensible precautions, running something from roots crontab is not usually a security risk.
But don't run a script as root that a non root user can edit or overwrite. This applies to jobs run from cron as well as interactively.
If that script includes other files same applies to them too.
If in doubt always use the principle of least privilege. If you are still unsure you can always ask specific questions on forums and in IRC.
There is (nearly) always a way to run something as a non root user. If all else fails using sudo to limit a user to specific commands also limits the potential to do harm.
So with the example you gave of backing up /etc/apache2/sites-available, that file is by default readable by anyone, so that implies it is access to the destination that is writeable by root only.
You could fix that by
- create a group called backupadmins (for example)
- set the group on the destination directory to backupadmins
- add a user called backupuser (for example)
- add the user backupuser to the group backupadmins.
- make the directory writeable by the backupadmins group
- run the cron job from backupuser's crontab.