Since MDL-58018 landed in 3.9 all of the known bugs have been ironed out and I think we are almost ready for it to be on by default.

One barrier is the default session cache is stored in the session - but then this is also a bug because it is possible and theoretically correct for code to use MUC to cache something in the session after the session has been closed even without readonly sessions being in the equation.

I think that we can implement a couple optional methods in the most common session stores, db and redis, which can correctly read and write session cache data without a session lock. If the configured session store declares support for this then readonly sessions would default to on. 

The simpler alternatively is to make the default MUC session cache something not in the session and deprecate the session store, but this would negate the performance benefits.