But the scenario you're talking about is not avoided by resetting or disabling web session association.
Anybody can unsubscribe anybody else by posting a form with their information, including the Unsubscribe field, as long as that field is not blocked from updates in the Marketo Admin UI. (And you can't block it from updates if it's on the form for the purpose of updating!) It doesn't matter if they have a cookie at all.
I think your Security Team needs a better grip on how public forms work. If you don't require a password or even a casual passcode, you're trusting (perhaps mistakenly) that the provided email address correctly identifies the interactive user. Whether the address has been previously entered in that session isn't really relevant. It only matters if it's posted along with the form.
You might instead require that a sensitive form post contain a secret code that is unique to the lead. This code can be passed in the URL and added to the form as a hidden field, so it doesn't need to be manually entered. And put a proxy field on the form instead of the real Unsubscribed field. Then, on the server, compare the secret code before performing the update to the actual field (which has form-based updates blocked but flow-based updates allowed).
But note this arrangement means you're blocking people from unsubscribing if they don't have their secret code on hand, so they will need to request one via email. In some jurisdictions, it's illegal to create such barriers to unsubscribing (yes, even if forged unsubscribes are therefore easier). Check with your legal counsel on this.
Some people attempt to use Click Link for instant confirmation, but this is too risky now with mail scanners prefollowing links.
.png)