EID Studio should install in the quickstart image which has an all-in-one installer. You should see it here after install: C:\Oracle\Endeca\Discovery\2.3.0\Studio.
As for the EID Studio SDK, read chapter 4 here: http://docs.oracle.com/cd/E29805_01/studio.230/StudioDevGuide.pdf
I just want to create a security extension. Do I really need to follow Chapter 4 Installing and Using the Component SDK?
When I ran the following command as instructed in Chapter 2 Security Extensions to Studio
It seems it requires Ant installed.
When you say Security Extension, I'm assuming you mean a MDEX Security Manager and not something that is Liferay specific. If that's the case, you don't need to install the EID SDK but it would 100% absolutely make things easier.
To illustrate, I've built multiple state managers, multiple security managers and even a cache manager across 5-6 versions of EID and I think I would burn at least a day, probably two, trying to set up an Eclipse environment to build an extension without the SDK. Using the SDK makes your life easier, not harder.
As to the rest of your question, yes the SDK requires Ant because when the SDK creates the skeleton of your project (complete with sample code) for you, it also creates an Ant Build XML to make things easier for you. One other note, if you're creating a Security Manager, you'll want to use create-mdexsecuritymanager.bat, not create-mdexstatemanager.bat.