From Salesforce Limits Quick Reference Guide - API Query Cursor Limits

A user can have up to 10 query cursors open at a time. If 10 QueryLocator cursors are open when a client application, logged in as the same user, attempts to open a new one, then the oldest of the 10 cursors is released. If the client application attempts to open the released query cursor, an error results.

So the cursors are a rolling limit where only the 10 most recent are kept for a user.

As you point out, Concurrent API Request will only be an issue if they take longer than 20 seconds.

You are more likely to run into the rolling 24 hour API limit that depends on how many seats you have. See Total API Request Limits.

From Salesforce Limits Quick Reference Guide - API Query Cursor Limits

A user can have up to 10 query cursors open at a time. If 10 QueryLocator cursors are open when a client application, logged in as the same user, attempts to open a new one, then the oldest of the 10 cursors is released. If the client application attempts to open the released query cursor, an error results.

So the cursors are a rolling limit where only the 10 most recent are kept for a user.

Also, if the QueryResult.queryLocator is null you haven't consumed one. In my testing when QueryResult.done was true with the first QueryResult there was no queryLocator defined.

As you point out, Concurrent API Request will only be an issue if they take longer than 20 seconds.

You are more likely to run into the rolling 24 hour API limit that depends on how many seats you have. See Total API Request Limits.