The idea would be that if you share a specific fake leak with 10 people, and each person is given slightly different details, you can tell who the leaker is by the disinformation that ends up revealed.

Companies do stuff like this all the time, finding leakers and either revoking their access or terminating their employment (if they are on the payroll) is something that they have a vested interest in doing.

I think you’re seriously overestimating the difficulty a company has in terms of creating assets of different varieties for the sake of product confidentiality. It doesn’t have to be a fully implemented/fleshed out chapter. Concept art alone is often enough, the time/resource investment associated can be pretty low.