Who are these "experts?" I'm a DBRE, and also very security conscious, and think this is an absurd what-if for most companies.

If it does matter for your application, then don't expose it - use an opaque id with something like AEAD, and expose that.