You should not listen to what “people tell you” unless you pay them, or they have an undisputed proven authority in the field (known security researcher, wordpress core contributor, etc), same way you probably do not listen to people that tell you that the earth is flat.
The ajax end point is less optimal in performance over wp-json end point, but it is nothing that you are likely to notice as a user unless your site does a lot of use of ajax, and they are neither more nor less secure from each other.
As for returning HTML in a response to ajax request, this is a bad habit but saves development time on both PHP and JS, especially when the HTML changes rapidly, so even here it is not a black and white situation. To have the flexibility of using the response in different contexts, you should use JSON, but if your ajax request are anticipated to be used in exactly one way, there is nothing horrible about returning HTML.