Maybe that (thread creation) can be done at open(), socket-creation,
service request, syscall or whatever event triggers a driver/subsystem
to actually queue work into a thread.
And when there is a close(), socket-destruction, service completion
or whatever these threads can be marked for destruction and destroyed
by a timer or even immediately.
If something is getting cheap, it is getting wasted just because it is cheap.