As far as I can tell, some sportsbooks have instituted a work around so the Heartbeat based attack can't work. But they have not done the necessary updates.
If SBR could provide us with a list of which sportsbooks have done the required updates, that would be great. It's no use changing your passwords until the updates have been made on their end.