I've installed the bundle JSS package. However, when I just go to localhost:8080, Tomcat's home page is show up. Is Tomcat's home page and management pages necessary for JasperReport Server? If not, I'll like to remove them because of security risk. In this case, would just deleting ROOT, manager, and host-manager directories cause any problems?
This a good suggestion. I think you are refering to the "JRS" installer (ie JasperReports Server) (too many acronyms - haha).
I will take a look at removing any appropriate tomcat management pages for the next JRS release (which is slated to be 5.6.0).
We do want to be able to get to some sort of page indicator when just going to http://localhost:8080 - becaues this helps with troubleshooting so that it is clear that tomcat is up and running ok (ie the case where tomcat is running but the JRS login page can't be found due to somekind of deployment/startup error).
But, yes, you can remove any additional tomcat UI related setups becase JRS will be at the http://localhost:8080/jasperserver url by default.