What's new in HTTP 2

This kind of question doesn't really make sense. How can the specification meaningfully specify the behaviour of things that are operating outside of the specification? When you're talking about a server which doesn't follow required standards and arbitrarily starts sending unrequested data, it makes no difference whether it's an HTTP 2 server with bugs, an HTTP 1.1 server with bugs, somebody trying to ssh into the wrong IP address, or just some random port scanner.

There is no difference between this problem and the more general problem of receiving unwanted TCP connections, and once you've realised that, the solution is obvious: RST, netfilter, filing a formal complaint, legal action, etc. (roughly in order, though in practice of course it's vanishingly uncommon to get past step 2)