Many of the users of my Java applets/applications don't have Java 7 installed (about 80%, surprisingly). If I compile my programs with Java 6,
Will the Java 7 users be exposed to the security vulnerabilities in Java 6?
AFAIK, It's Java 7 which has the most serious security vulnerabilities. How you compile the code doesn't matter, only what the code does and which JVM version you use.
Will my applet/application work with Java 6 and 7?
If it has not bugs, yes. If it has bugs, it is most likely to do the same thing on both, but possibly not. i.e. it might be that a bug appear in one version but no the other or in different ways on different versions.
Are there any disadvantages? I am not really using any of the new Java 7 features (except the diamond operator which is easily fixed).
The disadvantage is just that you cannot use the new syntax or the new Java 7 libraries.
How the code runs or performs is not changed.