As a follow up for T200630, the best and most flexible solution seems to be to add a maximum execution time limit while parsing (applying various regexes) to the UA string.
An initial investigation from @Milimetric looks promising: https://gist.github.com/milimetric/2a9ee4eaad6d2a1523dece6166e2eb90