5.3 stops getting security fixes in August. Deprecations first, then the behaviour changes, then the version bump — and an APC replacement that ignores every setting you tuned.
Xdebug is not something switched on for a request. Loading the extension replaces the engine’s function-call handlers for the lifetime of the process, so the overhead is paid…