When I run my website in Chrome on Android (with 8 GB of RAM), my website can get 6.5 GB of RAM.
When I run my website in any browser on iOS (iPad with 16 GB of RAM), my website can get 1.88 GB of RAM.
This much RAM might be needed only for a few seconds (computing a visual effect). A user is "focused" at just one app at a time. If a user uses my tool for hours, I think it makes sense to give them all the resources (CPU, GPU, RAM, ...)
Seems like the solution to the DoS concern is to just limit the site to whatever amount of RAM is currently available on the device - that's what every other browser/OS combination other than iOS seems to do without issue.
It would be pretty annoying if a random website can just DoS your phone by using all your RAM.