Alby queues all requests and processes them one by one in the same order the NIP07 calls were executed.
The extension also only knows whether to display a prompt or not after checking the site-specific permissions, blocklists, etc.
Discussion
It used to throw an error on a concurrent request iirc, not that's changed? If so then clients should be safe to send parallel requests, right? Those won't be executed in parallel but at least it won't crash.