It's not the link fragment portion of the URL in the address bar that is sent to DNS, it is DNS requests from additional lazily-loaded content that is pulled up when the browser jumps down to it.

Someone else went into detail: https://news.ycombinator.com/item?id=32742504

This requires the attacker to have third party content on the page you are trying to get the user to scroll through, that is a huge assumption no?

The password web page example is here highly unlikely: if the attacker injected his external content on the password web page, he has already a very strong position - getting users to click on links is not a logical next step, the attacker has far better avenues I would assume.

At least that's my understanding.