As long as the naming pattern is distinct from important domains you can still block it based on pattern matching. They need to obfuscate ad domains and other hosting domains the same way.

Creating subdomains is quite fast because the request goes right through when it’s unknown to caches, it’s updates when you reuse existing ones that causes trouble with lag.

I’ve tested making new subdomains, it’s literally minutes in real life. Sure, in some pathological case it might be hours, but it’s not actually going to happen realistically.