As of 5.3 / 2014.03, sessions are supposed to be lazy again, managed by Symfony. This was made possible by handling user authentication by Symfony security component.
However, accessing an eZ 5.3 website (frontend) will always start a session (and send a session cookie if one does not yet exist), even for anonymous users.
Culprit is eZ\Bundle\EzPublishLegacyBundle\LegacyMapper\Security::onKernelBuilt(). It indeed injects any user authenticated in the Repository in the legacy kernel, using eZUser::setLoggedInUser(), which triggers session start.