The behavior you're experiencing can be considered a bug in the current Simple Injector 2.3 release. We're working hard to ship 2.4 and I will make sure we fix this for the coming 2.4 release. There are more places in the framework where varient types aren't checked.
In the meantime, you can use the following workaround:
container.RegisterAll(typeof(IDataHoldingSession<object>),
Lifestyle.Transient.CreateRegistration<IDataHoldingSession<object>>(
() => container.GetInstance<IDataHoldingSession<string>>(), container),
Lifestyle.Transient.CreateRegistration<IDataHoldingSession<object>>(
() => container.GetInstance<IDataHoldingSession<IPlugin>>(), container));
UPDATE
Simple Injector v2.4 has been released. This release fixes this bug.