Have you set up a “backup” folder in the wp-contents root and given this folder 777 permissions as per the setup requirements? What version of WordPress are you currently running and are you backing up to your desktop or sending through an email account?

I agree that it is a security risk used in the wrong situation i.e. Subscribers, Authors, etc. This is a situation where WordPress is used as a content management system for a website that is managed by a single user. This particular user has requested that we handle updates to the website while they maintain updates and regular backups due the type of website and the visitors involved. What we have done is limit the client’s admin options while allowing them to maintain a backup of their site when they deem it necessary. Keep in mind that WordPress is not always used as in community situation and therefore this particular modification may come in handy to some.