Performance & security impact of enabling grpc server reflection

I want to know what would be the impact on performance of server on enabling server reflection & if there are any security concerns with it.

Reflection service couldn't impact performance, other than the memory it uses to track the reflection data. Depending on the language/implementation, the reflection service may be able to dump protobuf descriptors (which does not include comments) for any protobuf used in the binary. Whether that is a concern depends on your environment and service.

It is common to have it enabled all-the-time for internal services. When you have a reverse proxy that contacts multiple services depending on the path, the service is generally not exposed as you'd need a smart implementation that combines results from multiple backends and the proxy's configuration.