First of all the feature that Lucee/Railo reduces the priority always existed, that was never added because already Railo 1.0 had it.
This feature of course is limited to code executed within the JVM, of course when you do a db query, the DB server does not care about this setting.
We did of course consider different ways to identify a client, cookies of course is not a solution because with a DOS attack you mostly not get a cookie back. We are of course open for suggestion to improve this. Have in mind that this setting never blocks a client, it only slows them down.