I don't think it's any more unsafe than it already was; I don't see anything that suggests that using a KDirWatch once from another thread makes it unsafe to use from its main thread afterwards. Or rather, concurrently from multiple threads because that's what the mutex protects against.
Maybe David can tell us otherwise, but a priori it should be enough to add a warning in the comment that KDirWatch isn't thread-safe.

I've tried my benchmark app without the mutex locally, and managed to reproduce the double-free crash quite regularly (on Linux). I think it would have been observed in the wild by now if the result from projectWatcher was used concurrently.

You are concerned that the existing code that uses the getter might end up using the dirwatcher at the same time the filemanagerlistjob uses it?

In that case we'll need to export the ProjectWatcher class, and upgrade all code where the getter is used.

This would be much less of a concern if KDirWatch::addDir and KDirWatch::removeDir were virtual, right? That might be an easier change to get through upstream.

Why do what?

It's part of what happens when closing a project in KDevelop, but it isn't actually closing the project. It's telling the file manager to forget about the project. There is no current use case for the method in KDevelop itself, it's only for the benchmark. I tried to get the signal sent through the ProjectController (projectController()->closeProject(m_project)) but that seems to need more setting up. I don't have time to figure out what and if that is going to add noise to the benchmark (parser overhead, for instance).

The detach method could be useful in a mode where you want to keep a project open for quick reference (or snatching some code snippets) only and don't want to waste resources on parsing etc.