Yeah, I think in order for session fixation to work, you have to have multiple connections trying to use the same session, and trick one of them into reattaching to the wrong session. For HTTP + cookies, that's doable. But the only concept of a "connection" in mosh is this key shared between client and server and only stored in RAM, and there's exactly one session per server process, and one client per server. A new connection is a new session (you have to use screen or something if you want to connect to an old terminal).
There are occasional requests for the ability to write out the client key and cryptographic state to disk, so you can reboot your machine, kill and restart a process on Android, etc. without losing your connection. But they've been pushing back because it breaks this straightforwardness.