One common use is to test out your new contract code without using real ethereum. You could even imagine a time where you could run a fuzzer on your contract to

One common use is to test out your new contract code without using real ethereum. You could even imagine a time where you could run a fuzzer on your contract to try to find bugs. Personally I don't think there's a real risk of exposing your real Ethereum wallet by setting up a testnet, as long as you only let localhost connect to it.