I think I have found the correct answer myself.
A session cookie is used to keep state between requests. It can be used to track a login during an open browser session, but the session should be ended when the user logs out or when the browser is closed. A "Remember Me" token in a persistent cookie is not used to keep state between requests, it's only used to "skip" the login procedure and give access to specific pages that other wise requires a login. When you use
$_SESSION you're dealing with the session cookie and nothing but the session ID is stored in the browser or client and all the values you put into the
$_SESSION array gets stored on the server in a file (by default) that contains the values in pure text.
The persistent cookie for "Remember Me" is not used for anything like that, it only keeps a hash token in the browser in order for the user to be recognized and avoid having to log in every time he visits the website.
In other words, the session cookie and the persistent "Remember Me" cookie are two different solutions to two different problems.
You can "keep state" with the "Remember Me" cookie, but that is not what it is used for and it doesn't provide you with a session. You can use the session cookie to implement a "Remember Me" functionality, but that is not what it is used for, it is used to store state variables on the server and to keep state in a session.
However, if you implement the proper security features for cookies, i.e. only serve on HTTPS and use
httponly, then they are both equally secure with regard to the risk of stealing the cookie or the session ID.