1) What is an acceptable size range of objects that should be attached to a session? If I attach an object that can be 5k, and I have 10k valid sessions at any given time, that’s 50MB of memory which seems acceptable to me. Is that a valid way to approach the issue, or are there other significant concerns?
2) This is probably a dumb question, but if I attach an object to a session with a 2 week lifetime, can I access the attribute as though it were in memory for the whole duration of the session?
3) Is there any reason NOT to always persist session information to a DB?
Acceptable size depends on your use case and number of concurrent sessions. If your sessions last 2 weeks, then it is conceivable that you could have a lot of concurrent sessions, but if 10k is your anticiapted maximum then there should be no problem with a 5k session object (as your calculation illustrates).
As long as you have a reference to the session object (or are able to get such a reference) then the data will persist in the session. Remember that your session objects must be serializable.
You may not want to persist all session data to a db for performance reasons, especially if the session data can be easily recreated.