I don't really think this is a security issue. If an attacker is able to try executing sudo on your system, you have much bigger problems (for example, data exfil can be done by non-sudo users in many cases, or if your system is sufficiently old there's known priviledge escalation exploits). I don't think an attacker gains much knowledge from knowing whether or not they're on the naughty list.

If the attacker can execute sudo they can probably just alias it to a sudo that sends them the password and wait. The number of users on multiuser systems who don't have sudo access is just vanishingly small. Universities perhaps. But in most companies, if they trust you with access to the machine in the first place they'll trust you with sudo access.