The switch is inclined to be seen in different places. Today in a Samsung running e-1.5-q I find it in Settings > System > Developer options > Update recovery
Is there any risk of malfunction or security concerns by using TWRP?
I have regarded as a weakness especially in Samsung and Android 10, encryption is mentioned in TWRP FAQ
See also
which now includes a link to this article published by TWRP today
… but TWRP backups work for me, but they are only part of my backup strategy, if a TWRP backup failed to transfer one day, I could live with it. I tend to avoid expecting a TWRP backup to move across Android versions or devices, but it works sometimes!
On other devices there are reports that TWRP backups are problem free.