Calling this a security issue is probably too loud. Hiding the system files is only obfuscation, and we all know that obfuscation is not one of the best security practices.
But on the other hand, the least priviledge rule is. That means a user or a account should only have allowed accesses for what is required for its job or contract. Here clearly, you would have no reasons to be able to browse the root folder.
I still would not call it a security issue, unless you are able you look at the data of other customers (because that means that than can also access yours), but is probably a hint that the administrator is not really attentive to the best security rules. As such this is a hint that other more serious security issues could exist on this webhost.
But anyway, it is only a hint, not an evidence.