I think it still works. You have two scenarios where the attacker is efficiently using goroutines; (1) you also use goroutines or (2) you do not. In the latter,

I think it still works. You have two scenarios where the attacker is efficiently using goroutines; (1) you also use goroutines or (2) you do not. In the latter, the attack is more expensive for you. Another detail is that an attacker with many idle connections to your host might not instantiate any new ones. Of course, in the scenarios where the attacker is not using goroutines then you have the upper hand as well.