I'm not an expert in it by all means, but from what I've seen it is like having Google log all the http headers and servers connected to requested as well. This means that it is incredibly easy to, for example, track down certain servers with a certain exploit that you know about [1], or complete systems that shouldn't really be attached to the internet in their current state [2]. Not sure either of those are possible with Google.

[1] - http://erratasec.blogspot.co.uk/2009/12/shodan-scares-me.htm...

[2] - http://www.zdnet.com/blog/security/shodan-search-exposes-ins...