Is setting a sudo time limit to 0 seconds still required for secure macOS operations?

Before Mac OS X Sierra, the sudo configuration did not enable the tty_tickets options. That meant that the credentials were cached and accessible by any tty.

Since Mac OS X Sierra, tty_tickets is enabled by defaults, meaning that the credentials are only cached for a specific tty - thereby disabled this set of exploits (i.e. monitoring /var/db/sudo and trying to exploit sudo within the timeout).

I think your memory is a bit fuzzy regarding spawning the same tty, as the problem was really as described above.

Mac OS X Sierra was released in 2016, so for the last 5 years, users of the latest operating system version have been safe here.

In terms of security risks in general, you should note that there is (ofcourse) always less risk involved in having no cached credentials (i.e. timestamp_timeout=0). It has to be balanced with user comfort, as there are also drawbacks associated with having to enter a password many times a day (when using password based credentials).