What are the security considerations before allowing access AJAX API to anonymous users?
Is the visibility for your field defined in the profile as Expose Publicly and also with the Searchable checkbox checked? You might not have to fiddle with permissions.

Otherwise to directly answer your question, some of the other permissions might still restrict undesired actions, but among other things it gives access to the REST api (via civicrm/ajax/rest), so you'd have to check what your other actions are allowing. For example you could open a developer tools console in the browser and type (this uses civicrm/ajax/rest behind the scenes)

CRM.api3('Contact', 'create', {
  "contact_type": "Individual",
  "first_name": "John",
  "last_name": "Smith"
}).done(function(result) {
  console.log(result);
});


which would probably fail because you might not have the add contact permission enabled for anonymous, but you might be able to do something like read all the contributions, depending on what else you're allowing for anonymous.

Also the autocomplete might be limited by whatever you restrict it to in the profile, e.g. limit to a group, but you could use the api to locate other contacts and their info.

The bottom line is it depends what your other permissions are also allowing.