To fix the issue you can do Your default position should be to use singleton controllers which are thread-safe. This partly for performance reasons, as you say, and partly for reasons of good design - a large mass of stateful, request-scoped beans is a mess. Using request-scoped controllers (or other request-scoped beans) is a specialised requirement which you should only use when you have good reason to do so, i.e. you have beans whose state must be private to the lifecycle of that particular request.
Singleton design pattern vs Singleton beans in Spring container