Does using a custom query_var create a security hole?

Regardless of whether you registered new_var as a query_var, all GPC data (GET, POST, COOKIE) should be considered tainted. Basically, this data is user input. This means that you will need to clean and validate the data anyway.

Common cleaning methods include casting the variable to a certain type (like integer or string), using a regex to validate strings, etc. Also, if you are accessing $_GET data directly, don’t forget to do an isset() or empty() check first to prevent “undefined index” notices.

Edit: In the first place, my answer applies to accessing GPC data via PHP’s superglobals. That being said, if you use get_query_var() to retrieve your variable, as far as I see, you still need to clean the variables you registered yourself. WP will clean its standard query vars, of course. See the parse_query() function in wp-includes/query.php.