Custom Metadata Access Issue in Spring '20 in Aura Component

This is anticipated behavior - from the release note

This change affects Visualforce pages and Lightning components that directly reference custom metadata types.

You can see a related known issue for a visualforce scenario where the recommended workaround is indeed to use a wrapper class.

I'm on the team that builds custom metadata, I will work with our doc writer to see how we can clarify this.

Specifically to answer your question:

Does this mean that we cannot have a Custom Metadata in return type without that metadata access assigned on Profile?

Yes, the return value of the AuraEnabled method must be a type that the user has access to (or be a custom apex type).