why do drafts return as part of wp_query?

The problem is explained in the quote you’ve mentioned:

“Default value is ‘publish’, but if the user is logged in, ‘private’ is added. And if the query is run in an admin context, protected statuses are added too. By default protected statuses are ‘future’, ‘draft’ and ‘pending’.”

Ajax call is always considered to be from an admin context.