Note that bitcoin/bitcoin#25454 apparently also prevents a fingerprinting attack described in bitcoin/bitcoin#24571. (I'm not sure I understand the threat model under which that is considered an attack, though, tbh. There are many ways to fingerprint nodes.)

We initially tried to backport bitcoin/bitcoin#10345 as part of #6231, but that was reverted in #6276 due to a memory usage regression (#6268). If we want the headers-sync timer then I think there are two options:

a) implement the improvement to batch write memory tracking I suggested here and then (effectively) reapply #6231;
b) extract the addition of the timer (last three commits of #6231), without changing sync to headers-first. We would have to consider whether the timer semantically depends on the headers-first behaviour.