My bad, the number above points to the initial heap size allocated. The maximum heap size for a process is (or at least can be) limited nonetheless, with the max_heap_size option:

{max_heap_size, Size} - Sets the max_heap_size process flag. The default max_heap_size is determined by command-line argument +hmax in erl. For more information, see the documentation of process_flag(max_heap_size, Size).

Every websocket connection that liveview uses is a single process. Processes have (as per current documentation) 327 words of memory allocated to them, if you exceed that threshold the process crashes and the memory is freed.

The exception is when it comes to things like big binaries, those are stored in a different place and referenced from the process. This is a possible vector of attack as it is possible to create memory leaks with binaries that are not garbage collected correctly, but at the same time this is trivial to fix if detected and it highly depends on the implemented logic.