The cons is obviously that you won't be able to add users to a group in SharePoint, and you have to manage AD-groups instead. If you already have 10'000 SharePoint groups in your environment, you may have to rethink how granular you're setting permissions.
But it's true that above 10'000 groups per site collection there are performance issues:
Above 10,000 groups, the time to execute operations is increased
significantly. This is especially true of adding a user to an existing
group, creating a new group, and rendering group views.
Ref: Software boundaries and limits for SharePoint 2013
But if you only have one Site Collection, that's the real issue here, not the number of groups.
Security Token Caching Problem
In case you haven’t already guessed, “check security” is based on the external security token. Knowing that
it can be 24 hours before the external security is refreshed
immediately suggests one obvious cause for any permission mismatches.
If a user hasn’t physically logged into SharePoint within 24 hours
then we won’t see any changes in actual security in AD until up-to 24
Reduce the validation period that external tokens are valid for (see
- Give permissions based on SharePoint groups.
- The second option is preferable as there’s no time-delay in change –> authorisation effect.
Ref: Why SharePoint Check Permissions Can Give Wrong Results for AD Groups
More to read: