Why not just setup SSL in your development environment? It's seriously not that difficult at all, there's zero reason to use Ngrok (although I'm sure it does what it does very well), plus asking this question after you're already paying is kind of silly.
Can you speak to security? I love using ngrok to test stuff in dev that requires SSL without having to setup up SSL. Of course that means it's running through your cert. Obviously one shouldn't run anything protected through your system, but what is your visibility into that traffic?