If you use nonces properly, it won’t be possible to make the site to process fake request… So this part should be secure, but… There is still one security flaw in your approach…
What if I can make you to run my JS script in your browser, while you’re logged in as admin? It is possible.
This way nonce won’t cause validation error and your code will execute whatever I want – because you don’t verify input from user…
So all your security is based on possibility of injecting some JS to your site – and that’s pretty common – just take a look at malware history in WP…
It would be much more secure, if the template was loaded based on verified data. So don’t load it directly, but make a list of correct, secure templates and load them based on variable sent in POST.
So back to your 3 questions:
1. If I have secured the wp_ajax function (according to WordPress best practices) is it OK to use POST data to include a file within the WP Admin AJAX action?
No. It’s never OK to load any file based on path sent by user. It’s much more secure if you pass a variable and then translate this variable to path of a file in PHP.
2. Am I making it easier for attackers to abuse the system?
You’re not making it much easier, but yes – it will be possible to attack such code.
3. Is this creating an unnecessary back door in the system just to avoid writing several additional functions, ie: is it lazy?
Yes, it is. But you don’t have to write several functions. You just have to secure this one properly and remember – you should never trust anything that comes from user.