MIAB - domain name vs subdomain - security concern?

No security concerns.

box.example.com is normally how MIAB is usually setup because example.com will host a website, where box.example.com will host the mail, cloud, and webmail client.

But there is nothing stopping you from using just example.com