When you say Security Extension, I'm assuming you mean a MDEX Security Manager and not something that is Liferay specific. If that's the case, you don't need to install the EID SDK but it would 100% absolutely make things easier.
To illustrate, I've built multiple state managers, multiple security managers and even a cache manager across 5-6 versions of EID and I think I would burn at least a day, probably two, trying to set up an Eclipse environment to build an extension without the SDK. Using the SDK makes your life easier, not harder.
As to the rest of your question, yes the SDK requires Ant because when the SDK creates the skeleton of your project (complete with sample code) for you, it also creates an Ant Build XML to make things easier for you. One other note, if you're creating a Security Manager, you'll want to use create-mdexsecuritymanager.bat, not create-mdexstatemanager.bat.