They said the issue was due to TLS tickets and not setting keep alive values. TLS tickets are await of resuming a TLS session without having to renegotiate it, considering that you are only polling for a boolean, that negotiation overhead could be much greater then the actual being passed. This isn't something specific to firebase so that's why no library would mention it.

Keep alive is a flag that allows you to reuse a single connection instead of closing it, if it's closed then again you have to renegotiate things. So it sound like you may have been inadvertently spamming them with tls connection requests, the fact that they said they were counting blocked requests makes it passable that you were also sending invalid tls handshakes.

This would make the real issue that they had been previously underreporting your usage and now are correctly counting it. Now if they had wanted to keep your business they should have, you know, warned your first or helped you fix your code instead of just surprising you like that. The fact that the change was going to cause a customers bill to spike should have been a red flag to them.