The situation you need consider is what you'd do if you want to apply, say, EHP8 to ERP6 and that requires a NetWeaver upgrade - they usually do - but your GRC version isn't supported on that new NetWeaver version. So GRC is preventing you from applying EHP8. The reverse might be true if you want to upgrade GRC to 10.1 or 10.2 and the required NW release isn't compatible with your ERP/EHP combination.
I believe technically you can do it, but just to avoid a couple of extra servers you really wouldn't want to. You are just storing up difficulties for yourself in the future. Your Basis guy might think it is a good idea now, but he'll eventually come to regret it. And there's no standard way to split the two afterwards.
I'm not really sure there are any significant security concerns, are there?
Steve.