When I've used PrintTask, it was using locally hosted services, not AGO, so my experience might not apply. Past experience in general tells me that there's lot of situations where you end up needing a proxy page. It's not just for security, but any time you are trying to pass too many characters in a request, that's a circumstance that requires a proxy page too.
From the help:
A proxy page is necessary in the following situations:
The application creates requests that exceed 2048 characters. While there is no official maximum length for a URL some modern browsers have imposed limits. Using a proxy works around this issue by performing a POST request rather than a GET request. POST requests are not limited by the 2048 character maximum because the information is transferred in the header instead of the URL. Common situations where you may exceed the URL length are:
Buffer complex polygons then use the buffered geometry with a query task.
Specify a spatial reference using well-known text (wkt).
The application uses a service that is secured with token-based authentication , and you do not wish to allow users to view the token, or you do not want to transmit the token over the network between your Web server and your users.
The application edits features in a feature service, unless the application is on the same domain as the GIS Server.