Encrypted DNS is a thing, so snooping on those is non-trivial and not at all something you can be assumed to have access to.
How exactly would you as an attacker perform this rinse and repeat action?
All the security concerns I've seen for this seem quite contrived to me. And I say that as someone who assiduously avoids google products*
(*alas, except at work, because I can't really choose that)
1) Privacy-conscious browsers are trying to get exposure, so they are stretching an extremely narrow privacy risk into something extreme.
2) (I also believe) media companies are worried this will rob them of ad exposures, so they are incentivized to cover this as something scary.
3) The "bad guy" is Google. This means the amplitude of the story is immediately 10X larger.
- you visit a page at example.com that contains private data about you (e.g. bank account number, medical conditions, what have you)
- this page loads external resources only when they are scrolled into view
- it also hotlinks some image below the fold that a potentially bad actor can see requests to (maybe the image is on their webserver, maybe you're on a corp network and they can see dns resolutions, whatever)
So now I link you to: https://example.com/privatepage#:~:text=Account%201
Did the image get requested? If yes, I know your account number starts with 1; if not, I know it starts with something other than 1. Rinse and repeat.