The value for a given key is unique for each user; because of this using SessionSate is generally not recommended as it makes the app difficult to scale (it's hard on memory).
No, it doesn't make the app difficult to scale if it is used correctly. In fact, you may find it difficult to scale your app without it.
Obviously, the best practice is to limit the amount of state data in general. Open DB connections certainly don't belong there; this is why connection pooling exists - apparently your consultants didn't know about connection pools. Large objects are bad too - I'm sure people throw excessively large rowsets returned from queries in these things at times. It should be small bits of state data when possible.
With ViewState, for EACH request, there is the amount of viewstate data transmitted to/from the server and the decrypt/decompress/deserialization and serialization/compress/encrypt that needs to be done. This is potentially a lot of overhead. You've saved memory at the expense of CPU usage and more network data transfer. Sometimes this is ok.
SessionState stays on the server side and you can configure it to go to a centalized memory storage server called the StateServer (like memcached in the PHP world....Facebook makes extensive use of memory based key/value pair databases for speed). You can also send it to a SQL server, which has its own set of issues too. (http://msdn.microsoft.com/en-us/library/ms178586.aspx) You're now just dealing with serialization/deserialization and data transfer over a much higher bandwidth local network segment as overhead. Less processing overhead per request means less hardware needed to scale.
The idea is to make your app able to add or remove application servers without affecting the users sending requests. ViewState would allow you to do this, but you may compete with page controls filling it with excessive data. At some point, the overhead of dealing with ViewState will exceed the overhead of dealing with SessionState. But by that point you're going to have a hard time figuring out that you need to switch to SessionState.
mod: added a quote bit because you otherwise it's just a random reply in the middle of nowhere. —dh