It wasn't winterba.sh itself being blocked that was the problem, but cdn.prom.sstatic.net (our promo CDN subdomain). That's where the Winter Bash JavaScript file is loaded from.
This file was loaded synchronously and thus blocking, which should almost always be avoided, especially when loading something peripheral like this, where synchronous loading is unnecessary. The domain being actively blocked made this fairly obvious, but it had a performance impact for all users.
The script is now being loaded asynchronously everywhere, so the timeout when trying to load the JS file isn't going to impact the rest of the functionality.