Well at least it works in some fashion now... no idea why it won't display from the default directory though; that's just weird.
No there's no security problems with having the error directory there; on servers hosting multiple sites, having the error directory one directory up from the web doc's can be usefull, as it allows for a seperate directory (and hence unique error doc's) for each domain. But you're probably not worried about hosting multiple sites just yet....