It's a compounding effect, so depends how many people use the bad clients. Partial mitigation is possible using nginx rate limits but it's not a pretty solution