Question: What are the risks of doing this? I understand the documentation says not to do it, but I have password protected all the pages.

Answer: 
The point is that your "password protection" is useless if a hacker can simply bypass that and read your database directly. We don't know if they can, but - as the docs say - the dev server has undergone *no* security testing whatsoever, so they might well be able to.

Plus, the server is single-threaded. It will only ever be able to serve one request at a time. That makes for a very slow experience for your users.

Seriously, there is *no reason* to do this. Setting up Apache + mod\_wsgi, or whatever your preferred hosting environment is, is a five-minute process if you follow the very detailed instructions.
If you mean, you want to deploy your Django project, you should use something like NGINX etc.

If you just want to tell, what if a development server is public, you have the same risks with any another project written in any platform.