most likely you should not. (ok, “don’t have to” is a better phrasing)
nonce in meta box do not add any security as the whole submittion of the form happens only after the form’s nonce is verified.
You might need some hidden input to be able to detect when the save filter is called from the post edit form and when it is called from the bulk edit or from an api. For this you can use a nonce field, but any othe hidden field will do as well.