It is 100% true. But the users can do strange things. If we solve idle transactions and not idle session, then they are able to increase max_connections to thousands with happy smile in face.
I have not strong idea about how to solve it well - maybe introduce transaction_idle_timeout and session_idle_timeout?
What exactly do we want to define session_idle_timeout? Some
possibilities:
a. Reset the session related variables like transaction, prepared
statements, etc. and retain it for connection pool kind of stuff
b. Exit from the session
If we want something on lines of option (a), then I think it is better
to have just a single time out (session_idle_timeout/idle_timeout)