A security issue with require(send()) in Solidity

Question

I'm working on a uni project based on blockchain, and I have to audit our system, check known attacks, ect. This the the document that I check, principaly, since i start to work on smart contracts issues first : Known-attack ethereum smart contract

I have trouble understanding the example used in the "Dos With (unexpected) revert attack" part. I share the code :

    // INSECURE
contract Auction {
    address currentLeader;
    uint highestBid;

    function bid() payable {
        require(msg.value > highestBid);

        require(currentLeader.send(highestBid)); // Refund the old leader, if it fails then revert

        currentLeader = msg.sender;
        highestBid = msg.value;
    }}

They say that an attacker could force the call of bid to revert everytime so no-one is able to bid, which would make the attacker win the auction by default. But.. How would he do that, that's the part I don't get. Do we agree that at least this piece of contract is the "valid one", and isn't a payload ? If the payload is a contract, can anyone provide an exemple/explanation ?

I'll add that, if here I quote a solidity contract, we work with Vyper, but from what I read before, this is still a kind of issue that i'll find there too.

Thanks in advance !