Just for the record, investigated it closer and whilst the bug exists, it's not a vulnerability with effect. What happens is that a malicious websocket client can prevent a durable object with the hibernation API from evicting a ws connection, thus it incurs running costs.