> refusing br content-encoding at the edge seems like the fastest mitigation.

That's pretty difficult if you make outbound requests, and don't already have a TLS interception proxy set up.