thanks hannes for the explanation. is this a bug or a feature? can we do something about it?

I vote for bug. But not a really bad one. What we could do is get a array copy of the site collection (using root.list()) and loop over those, so we have the guarantee that the array won't be modified while we're looking at it. The problem is we can't do that with a collection containing all sites (because making an array of 1000+ sites is too much overhead in per-request code), so we'd have to do a recently mod-collection of sites with something like

sitesByUpdate.maxSize = 50

so the collection contains only the last 50 sites.