The goal of the attacker is to guess the password. By observing the authentication message, the attacker already learns enough to "try" passwords at home (i.e. an "offline dictionary attack"), but that's not what RFC 2617 is talking about at that point. Rather, it concentrates on the idea of an attacker who impersonates the server, and thus feeds "server" nonces of its choosing to the client. The client responds to such a nonce by hashing the server nonce, the client nonce and the password together (I voluntarily skip the details here). The attacker may then try to exploit some internal weakness of the hash function to recompute the password from what the client sent. What the RFC 2617 tries to say is that omitting the client nonce can only makes things easier for the attacker (at least provably not harder, and heuristically easier) -- as a corollary, using a client nonce may help in protecting the client in case the hash function is flaky; a client nonce will certainly do no additional harm.
Now no exploitable weakness of MD5 is currently known, when used in Digest Access authentication as described by RFC 2617. Even though MD5 has shown considerable flakiness with regards to resistance to collision, which is another, distinct security property that a good hash function should have (and that MD5 has not). So the protection offered here by the client nonce is only hypothetical. But, as I said, it does not harm either.