It seems the issue has been fixed for Godot 3.1. If you are using Godot 3.0, I would suggest to continue development and not worry about the inability to disconnect users and then add disconnecting to your game when Godot 3.1 is released.
I am not sure when Godot 3.1 is coming out, but I imagine there will be at least an alpha release before the end of the year, so the wait for Godot 3.1 should not be too long.
If I understand correctly, hackers can fill up the connections to my games, and I have no way of disconnecting them..? Is there something I could do?
Technically speaking, no there is nothing you can do about it in Godot 3.0, because there is no way to force a disconnect.
There are ways you could reduce the damage though. One way would be flagging/marking bad connections, and ignoring anything and everything sent by a flagged/marked connection, though this method would generate a bit of a performance overhead.
If you can, I would suggest waiting for Godot 3.1 instead of trying to make/find a workaround. If you are not planning to release your project using Godot 3.0, or do not have a upcoming deadline, then you can probably just make a note (so you do not forgot to add disconnecting once Godot 3.1 is out) and keep working on the game like normal.
I think Godot 3.0 code is more or less compatible with Godot 3.1, so at most you should only have to change a few things when you migrate the project over, and then you can add disconnecting using the newly added ability to disconnect users.
