When a standard (non-administrator user) selects a WiFi network using the applet, the applet attempts to create a system connection, instead of a user connection, and thus it asks for an administrator user's password.
On the other hand, if the same standard user opens the WiFi settings and selects a network there, no admin password is requested, as the connection is created for this user only, not system-wide. This is a workaround I discovered recently (see https://askubuntu.com/a/1163852/375543).
This has bitten me several times, as I hand out laptops for new users; when they get home, they try to connect to their network and as I have no other way to help them (before I discovered the workaround), I ended up giving them the administrator password.
The applet should not attempt to create a system-wide connection for users that are unable to do it. There is no security implication to implement this, as the users are able to create a connection anyway with the workaround mentioned above. But the improvement in terms of UX would be huge.
Same is true for activating configured vpn connections. nm-applet asks for admin password and if you cancel that popup the connection is nonetheless established