Yes, both through DNS requests (although one maybe could somewhat mitigate that by having each visit to the main domain trigger requests to the subdomain, a) creating traffic and b) putting it in peoples' DNS caches) and HTTPS (All modern browsers include the domain via SNI).

It still might be a better choice, given that the main domain for many sites goes through CDNs and more complex systems in general, increasing the risk of compromise there (which also would expose network details about the submitter, and possibly even more)? A dedicated securedrop site hopefully has dedicated infrastructure and better security.