Can you tell me what the Enable global object security policy is really doing and what is the real risk of disabling

This policy basically disables the use of a scripting object that is "global", ie accessible to all programs running from all contexts in the application. It can even be used to save information across sessions. Since this object is literal anyone can access anything that is saved in it, even without knowing the name of the items within it.

This can be a security risk in some cases, so you have the option to disable it.

A responsible developer would avoid saving sensitive data into this object, or make sure to encrypt (or hash, or at least obfuscate) it.

Keep in mind it might cause some scripts not to work correctly if you enable this option...