WordPress.org

Isn't there a possibility that an inactive plugin has a security vulnerability which could be exploited if I'm not notified of the update?

Yes, but the likelihood of this happening in reality is negligable. There are better things to worry about.

How does this affect update checks in Multisite?

With this plugin active, a Multisite install of WordPress will only check for updates to network activated plugins and plugins which are active on the main site.