Should I use Symfony Flex on production codebase?

This is a good question, because "avoid not-useful package" is always a good idea to "avoid compatibility problem".

Should I use Symfony Flex in production codebase?

In your installation process, you use a command provided by flex: dump-env, so you have to install it in production. So I think you should use it.

The main problem with flex, it's that it can alter your source code and env-files. But, in your installation process, you don't call composer update, but composer install. So, flex won't update your source even if any bundle have new recipes. I guess that your env file will be updated during your install process. So, there is no problem to let this package in production. You can replace it with a personnal command. I guess this package is tested and stable. A lot of developers and maintainers use it. So, I guess it's "bug-proof". Will your command be more stable? I don't think so, even if you copy the source code, because your code won't be always sync with flex command.

Flex is integrated to Symfony. We can even say that flex is used to integrate bundles of symfony. So there is no risk of uncompatibility.

if yes, what are the other reasons to use it? does Flex affects app performance somehow?Flex does not affect performance of application as it's never called. "Never" is not the good term, it's only used when you call dump-env command.

Another reason: symfony-demo and symfony-skeleton are application which respects the Symfony best practices. Symfony team decided to let flex in prod package, not in dev packages.

So, as Jakumi said in his comment, "I don't see reason to avoid this package in production". It's right ! Moreover, I see a lot of reason to use it in production.