The snooping of unencrypted SNI in the TLS handshake is a known weakness that is still mostly unresolved despite four years of standardization effort. The encrypted SNI work has been revised and updated to encrypted ClientHello and is still technically an IETF draft and not yet formalized in an RFC:
That said, CloudFlare, Firefox, and Chromium teams have all been working toward the evolving spec so one can hope that soon with eCH and DNS-over-HTTPS we will be able to have clients securely connect to servers without broadcasting the hostname to which they are connecting.
https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
That said, CloudFlare, Firefox, and Chromium teams have all been working toward the evolving spec so one can hope that soon with eCH and DNS-over-HTTPS we will be able to have clients securely connect to servers without broadcasting the hostname to which they are connecting.