This is a good question. Yes, the the Quad_Plant_top model and px4Demo_FlightController_top model run in lockstep with each other. However, the TCP Read from Host Target block in Quad_Plant_top model, is set to read 50 bytes of data at each sample time. This is not enough to read all the data sent from the controller model. Hence, the plant model has to run 2 times to get all required HIL* messages from the controller and then respond.
Playing around with the TCP Read from Host Target block should ensure the time matches in both the controller and plant model. But rest assured that they are in lockstep. This can be noticed while pausing the using the step through functionality in the plant model.