Are there security consequences from not giving printf a format to use?

A well-formed printf usually has a format to use:

$ var="Hello"
$ printf '%s\n' "$var"
Hello

However, what could be the security implications of not providing a format?

$ printf "$var"
Hello

As the variable expansion is quoted, there should not be any issues, are there?