Allowing arbitrary TCP sockets originating from the web browser means that an attacker can use the browser as a trampoline to connect to arbitrary services on the users local network. This can for example be local mail servers which often are setup to trust any internal system to send mail and thus can be misused to send phishing mails which look like they came from a local system or simply to send spam. But also other services could be affected.
WebSockets instead are an application layer protocol on top of TCP. They start with a HTTP based challenge-response and continue with a protocol using frames which are additionally xor'ed with some previously established random key. This is specifically done so that this protocol can not be misinterpreted by unsuspecting TCP servers.
how are they not applicable to websockets?
While it is true that WebSockets are considered much less dangerous than plain TCP they are not innocent. If there is an internal application which can be accessed using WebSockets explicite measures must be taken at the server side to restrict access to this application. WebSockets are not covered by the same-origin policy in the browser, i.e. it is possible to cross-origin connect to a WebSocket server and any restrictions to this need to be employed at the server side. See also Cross-Site WebSocket Hijacking (CSWSH).