I have, when organising plugins, moved a plugin or folder of plugins while Sonar is running. I did this on an occasion with X3, simply to test what Sonar was doing. It does indeed detect while it is open if you move plugins. First it acknowledges that new plugins have been found others moved and or deleted and then that it's reorganising the plugin menu.

Obviously while you're doing that you're not recording or bouncing audio or whatever the case may be. I can't imagine that whatever process is resident in memory to accomplish finding this change is not very resource heavy and seeing as you wouldn't conduct this task while something critical was going on I don't see the issue.

i'm not cakewalk (or john!) but i'd like to speculate that it's standard "folder watch" code that fires an event when the contents of the folder change, and that event is handled by sonar/the scanner, a "watch" doesn't consume any cpu (i.e., it's not continuously "polling"), how does that sound?

An initial scan, when Sonar starts, used to take about 20 to 30 seconds on my 32bit install, after a full reboot of Windows7. The scan could take upward of 30 seconds if the computer had been used for other processes prior to opening Sonar (e.g. checking email or a long internet session with Internet Explorer).
I have since disabled antivirus checking of those folders that are scanned, and the scan now takes between 5 to 10 seconds depending on what is resident in memory when the scan begins.
I always wait until Sonar has completely booted and "settled" before beginning any project work, it's just a habit from decades of using a computer.

Right its event driven so there is no polling in the app. This is the same mechanism that Windows uses to update Explorer when the file system is modified externally. Its very low level since its handled at the file system level and you get a notification only when something has changed. The watch code is in Windows not SONAR so it wouldn't even register on SONAR's CPU usage. There is more information in MSDN here if you want to read the details.
 

Great appreciate your answer, so Kylotan is right. It's confirmed it runs in it's own process when the vst scan actuallly happens (away from the main app) so I assume it terminates after the scan?

And by switching to manual this turns off the hook into windows you specify (link above)?