The note is about the use of is_admin() to determine if a user has privileges to do something, because in every other context except admin-ajax.php, that will only be true for a logged in user. You can still use the API to determine if a user is logged in and who they are, and as long as you do that, and operate on that data, it is as safe as any other type of request.
Nonces can increase security by enforcing intent to invoke an action. Links that trigger AJAX requests can be forged by others, and if someone gets a logged in user to unknowingly click one of those links, it can invoke an action the user did not intend to. Nonces aim to prevent this by adding a unique identifier that is only good for a specific action, and expires. By checking that nonce, you can be more confident that the user intended to invoke that action and the request is not forged.