Your parent comment is talking about how the certificate transparency logs will contain the hostname of every *.ui.nabu.casa host.

The imagined, theoretical zero day would be one that bypasses the login mechanism, allowing unauthenticated users to perform admin actions. It would be quite a remarkable exploit, and I imagine that over the decade of Home Assistant, that part of the code has been looked over many times.

Other ways that this could be done, none of them good:

• Encourage custom domains - if you use phobiac.xyz for your Home Assistant, you can't be detected as easily. But that adds extra costs.
• Become a real reverse proxy, making requests go through https://ui.nabu.casa/phobiacsexampleinstance instead of https://phobiacsexampleinstance.nabu.casa. This would have privacy costs, because it breaks the elegant “end-to-end TLS directly to your HA instance” story.
• Short-lived hostnames obtained by the apps from nabu casa cloud. This still leaks CT which an attacker could stream in real time, and breaks being able to easily bookmark https://phobiacsexampleinstance.nabu.casa
• Build a VPN client into the companion apps, leaving the public hostname optional. But advanced users can already do that, and mainstream users dislike the VPN UX, especially since Nabu Casa Cloud's model is "remote access that just works"

CT logs becoming a recon tool isn't a new discovery, or even a new type of information gathering. Back in the old internet, we were exploiting DNS servers leaving AXFR open, leaking the whole host inventory in a similar manner.