WebSockets and Third-party apps

Hello! We have a Cloudflare App and the same code is available for integration with Workers. One of our customers is using socket.io and they said that if they install our app, their requests get blocked by Cloudflare WAF (OWASP rules). We managed to reproduce this: seems like socket.io switches to using https instead of wss if our app interferes. However, if we use the same code with a worker, messages are sent via web socket channel and not analyzed by WAF, i.e. it works fine. I was wondering why App (that relies on worker) and Worker versions work differently with WebSockets? Thanks in advance.