Excerpt from Redis' security article:
Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket.
AUTH command aside for a minute, I think this makes sense--if your program is only designed to operate under trusted conditions, why bother adding authentication to it? I believe this is the route micro services typically take. Each service is free to communicate with other services in the same network.
But are databases (MySQL and the like) a different story? Typically, I will configure multiple user accounts, one for each micro service that only has access to its own database (under the entire database server). However with the route Redis is taking, is this still necessary?
Are access controls redundant, or is Redis less secure than classic databases?