Hello,
I just found this bug. I'm on APEX 22.2.1 and I've got the "Friendly URLs" setting turned on.
Log in to Workspace (App Builder)
Open an Apex application in that workspace
Click on Customize > Theme Roller in the Developer Toolbar
Refresh the App Builder page
Expected behaviour: Nothing
Actual behaviour: Session has been removed, you're logged out of the App Builder
This also results in the Theme Roller being unusable, since any changes there will not be able to be saved without that session. This can be circumvented by turning off "Friendly URLs" in the settings (temporarily), which will make it work as expected.