Yes it would be a security risk.
db_datawriter gives the account access to all tables in the database. This means that anyone getting control of the web user can delete all content.
A better solution would be to create an new role in the database. Assign the entity framework user to this role and only grant the bare minimum privileges needed to run the app to the role. Ideally, the Entity Framework would only read tables via
GRANT SELECT (maybe even only some columns) and perform all writes via stored procedure with
GRANT EXECUTE enabled.
An even better solution would be to not use Entity Framework at all. Like every other ORM on the planet - it is horrible way to access a database. Tell your programmers to learn SQL instead of fooling about with Object Oriented database access frameworks.