I am using this workaround to get the SessionId in my LWC and perform a callout from the JS. I am concerned about if it will pass the security review for managed packages. Have someone used it and can confirm?
Also, if used it in managed package, does it work properly or does it face the error pointed here by lambad in the response comment?
I just took a look at the new Salesforce Managed Package: DevOps Center. And found the following:
Even themselves are using this hacky approach, so I assume that they could never push back your managed package application during a Security Review due to the same reason.