It is possible, though not very plausible that leaving old kernels installed is a security risk.
New kernel versions generally patch security problems. When you boot into a new kernel, you should be protected against these security problems.
Here's a scenario in which it would be possible to exploit this:
- Attacker can remove kernels from your boot partition.
- Attacker removes newer kernel versions, forcing the user to boot the older, unpatched kernel.
- Attacker gets user to boot older kernel.
- Once booted, the attacker uses the vulnerability to gain access to the machine.
This is possible, though not very plausible: generally if an attacker has access to your machine, you're going to have a bad day. He could almost as easily compromise your initramfs, even with full disk encryption enabled, and install a keylogger or worse.