Locking the session in pluginfile.php means that if you visit a page which locks the session and actively does something for maybe even a few seconds any images loaded through pluginfile cause a php process to be waiting on the lock to become available again. This leads to both a bad user experience and worker starvation as a lot of php processes may end up waiting for the session lock if you have many users and many images. Especially since the increased delay in checking for a session lock after 5 seconds means these processes do not even immediately continue when the lock becomes available.

As a consequence pluginfile.php should not lock the session if this option is available.

Identified the problem on 3.9.4 but still present in master.