Unfortunately there are no guarantees here.
For “normal” use prepareToPlay is called on the message thread, then processBlock is called on the audio thread. If you are doing non-realtime rendering then both could be called on a different non-audio thread or the message thread.
Well behaved hosts won’t call both prepareToPlay and processBlock on different threads simultaneously, but there are a handful of badly behaved hosts out there. Usually when any of the JUCE team makes a statement like this we get a handful of people saying “I’ve developed plug-ins for X years and we’ve never seen a problem…” so if you’re not doing anything unusual then you’re unlikely to run into trouble. Edge cases do exist though: