As far as I know the buffer is not actually allocated, the value is just a threshold: when the socket is gathering data for delivery to the application, it has to give up at some point and notify the application. The memory is only used while data is queueing up, and released when the application is done with it.
I do think a large buffer size could be a DoS risk: if a server uses a 10M buffer for all incoming sockets, then a malicious client could send 9M of data with no newlines on a bunch of sockets and possibly eat up the server’s memory long before the socket limit (ports, file descriptors) is reached.
