If I checkout a working copy into the www root of my site, would that be a security vulnerability?
Assuming your code is properly written, and written securely, and you never checked in sensitive details (passwords and keys!); then disclosing the .git folder and your source code wouldn't create any security vulnerability that wasn't there in the first place. However, having access to your source code makes it easier for an attacker to search for an actual vulnerability; and you probably do not want to make life easier for the attacker.
Additionally, the attacker might be able to obtain a copy of the source code, which may be an intellectual property issue, but that's not really a security issue.
Just make sure that your .git directory isn't accessible from an HTTP request, and you should be golden.