What does it mean that sp_who2 is not documented?
It is "not documented" means that it is not part of any officially published API so there is no implicit or explicit promise that it will work in any given way, keep working at all, or not just vanish at any time (perhaps a security hole is found relating to it so MS just decide to disable it, temporarily or permanently, because fixing it quickly isn't practical).

It is unlikely that this will happen, it is likely that it will stay around in its current form, but there are absolutely no guarantees of this so if you choose to rely on it you do so at your own risk.

Also as the behaviour of the call is not defined in any official documentation MS have no obligation to fix any bugs in it in a timely manner or at all (as there is no official documentation that describes its behaviour any behaviour it exhibits could be considered correct).

On a related note: all the information it outputs is available from documented system tables and views (you can script out its code from master to see what it does) so you could write your own that collects even more information to output - for years I had my own "sp_who3" that did just that. These day's I use Adam Machanic's sp_whoisactive instead.