You underestimate the desire for precision tracking, unfortunately. Hiding behind custom subdomains is common.
Stepping up to cloaking it to be delivered from the application is more effort but it'll happen.
You overestimate the technical ability of publishers. Frankly, it’s pathetic to rely on a third party’s hot linked JavaScript, but no one can be arsed to understand how it works, so they just add the tags to GTM instead of realizing that they could trivially implement A/B testing or whatever themselves.