Whether you think it is true ‘domain fronting’ or just something that is similar, this post walks through how Cloudflare use SNI to protect against attackers modifying the HTTP Host header and then how ESNI can be used instead to help ensure any ‘bad’ traffic goes unnoticed by observers.
Article Link: https://digi.ninja/blog/cloudflare_example.php