Obviously, it's easy to have multiple parallel requests accessing the same @SessionScoped bean in a web app context. Am I correct in believing that I have to explicitly control synchronization when accessing the @SessionScoped bean within those requests?
Depends on what you mean by:
explicitly control synchronization when access the @SessionScoped bean within those requests
You are right that there may be several threads accessing the @SessionScoped bean in parallel. So generally you have to take care of the thread safety. Whether you need to explicitly control synchronization (or synchronize at all) depends on how the shared state is used or modified from different threads. If you use classes from java.util.concurrent or java.util.concurrent.atomic, you may achieve perfect thread-safety without a single synchronized statement.
But yes, you have to take care of thread safety.