I recently installed an application that would not run until I made an exception for it in Windows 2008 Server. I've seen the same on a Windows 7 system. Assuming these are commercial applications without trojans, what is the risk in doing this?
Well that is the idea behind 2008s DEP. Previously it was set for services and essential programs only. On Server 2008 though it takes the other approach and lets you open up access accordingly. This is actually a more secure way of doing this, denying all and granting access as needed. As long as they are as you said, "commercial" applications, there shouldn't be a problem in making an exception for it, in fact that is one of its features and that is why it is there.
A short post to help you understand why on a Server 2008 machine, it shouldn't be much of a problem.