One could be forgiven for assuming that modules which are only specified in a particular vhost's modules_enabled block are only loaded on that vhost - this is not the case with some modules. mod_bosh and mod_websocket are a couple of outliers in this case, where they'll be loaded globally on all available vhosts regardless of if you put them in the global config or a vhost's specific config. Whilst not harmful, an unaware operator might be confused as to why websockets are now enabled on all of their vhosts, as the logs show but do not explain why. I suggest that where modules are loaded globally by default, a warning is displayed in the logs for each module mistakenly placed in a vhost's config. Let the server operator know that the module will continue to function as intended but for clarity/documentation purposes is better suited to being in the global modules_enabled block. From my discussion earlier with Zash, it seems that modulemanager might already possess a lot of the logic required to make this distinction.

As of Prosody 0.12.x, mod_bosh and mod_websockets are what is called "shared" global modules. They can be enabled on a single VirtualHost and this should behave as you expect. This has been changed back and forth a bit, in 0.11 they were global and behaved as you describe, but earlier this was different.