I once tried to set a hostname to host 
(for non-privacy related reasons: embedded systems is another area where boring and straightforward names are common). In any case, that ran into some issues, I don’t remember with which program. But yes the internal host name and the public DNS name for services are almost always different, and those stats are clearly about external names.
The only way I can see this happen is with some Apple-specific proprietary API (or indeed, an old version that leaked this in the User agent, though it makes little sense). In a far past with Java and ActiveX it was also possible. But I’d definitely see that as a serious privacy leak too !
In Linux there’s another way to prevent these kind of leaks: network namespaces allow setting up a completely different network stack for some applications. There’s also UTS namespaces that allow setting a different hostname and domain name. You could run any application that you don’t trust to not reveal this information in it. I’ve used it for steam and also browsers at times.
Sorry to hear it didn’t work I haven’t tested those network-manager settings myself, I might at some point. TBH I hardly get to connect to untrusted networks anymore since the virus…. 
Yes, good point. I’ve definitely seen this with mail clients. FWIW mutt has some options to control this:
set hidden_host=yes
set user_agent=no
Buut sure, having to do this for every single thing is brittle. It would be nice if there was some Linux distribution was proactive in this.
I think everyone that once accidentally shut down the wrong host over ssh would agree.