I think the Thread-Safety you are talking about is an offer without reuse
Enterprise JavaBeans 3.2 Container Provider Responsibilities, Final Bean Release Contract April 10, 2013 14:59 Oracle
4.10.13 Non-returning instances A container must ensure that a single thread can execute an idle session or session with a Bean instance state at any time. Thus, statef ul and the idle beans session do not need to be encoded as reentrant. One consequence of this rule is that the application does not make loopback calls for stateless persons or a session with a state of Bean instance
You can in a session without a bean state, ignore the restrictions on EJB programming, create a bunch of threads and do something non-streaming safely. the container will not stop you. This can cause all kinds of errors due to flow control conflicts.
The container only promises that it will allow only one stream of access to an element without saving state at a time. (there are some rules regarding single numbers)
You are correct that if instances return to the pool, then the connections in your example can accumulate. because of course the instance still exists.
If you delve into the application server documents, that is, in the Glassfish EJB pool configuration chapter, you will find that by default you need to destroy the object instances and not return them to the pool. same with JDBC connections to be closed and cleared. Reuse is an option, in which case you can consume additional memory if you are trying to create state in SSB. I do not think that the performance effect is strongly affected if the instance sits idle in the pool.
the exact implementation of the federation depends on the application server provider if they comply with the specification. I think you will find that the default behavior is to destroy the instance after use. Which forces cleaned up managed resources.
But all this is kind of dumb, in your example you are trying to save the state, the connection field, in the class. There is no need to create a state in a component without a state for which this type of component is not intended. Other parts of the Java EE architecture handle state. (entities, statefulbeans, JCA)