Note that there's two different things we're talking about here- the lock on the relation that we're analyzing and then the lock on the pg_statistic (or pg_class) catalog itself. Currently, at least, it looks like in the three places in the backend that we open StatisticRelationId, we release the lock when we close it rather than waiting for transaction end. I'd be inclined to keep it that way in these functions also. I doubt that one lock will end up causing much in the way of issues to acquire/release it multiple times and it would keep the code consistent with the way ANALYZE works.
ANALYZE takes out one lock StatisticRelationId per relation, not per attribute like we do now. If we didn't release the lock after every attribute, and we only called the function outside of a larger transaction (as we plan to do with pg_restore) then that is the closest we're going to get to being consistent with ANALYZE.