ASM Cookies - Secure and HTTPOnly flags

Re 2: The only downside I see is that which the solution article makes note of: increased processing/resource utilization. If the ASM cookie is causing no negative affects on the server-side then I would let them be.

Re 3: You are correct, ASM cookie cannot be disabled. It is integral to ASM security features. The TS cookie is inserted into every request which is handled by an ASM security policy (if the cookie is not already present). If you are seeing traffic that does not contain the TS cookie then my first guess would be the traffic is not flowing through an ASM security policy but is being sent directly to the pool.