You mean SNI, not ESNI. ESNI is the Encrypted Server Name Indication that gets around that, though the newer ECH (Encrypted Client Hello) is better in many ways. Not all sites support either though.

NixOS + Home Manager user here.

I run in an opt-in state config. / is tmpfs. /home is tmpfs. /boot and /nix are real filesystems. At boot, the EFI loader reads the configuration from /nix/persist/etc/nixos/flake.nix, symlinks all the programs and configs into / and /home, and startup proceeds as normal.

That means nothing persists across boots unless I add it to my config. Cruft doesn’t accumulate in hidden areas, it’s all in my config. That keeps things fast, makes management easier, and makes troubleshooting easier.