Using icloud.com domain for legit and hidden adresses is such a typical Apple strategy of holding their own users and "others" (ie. other web services, other users etc) hostage simultaneously. But at least here it is actually a good reason that works for the user.
how is the user being held hostage? you can redirect hide my email addresses to any domain
Case in point: many websites block all VPN except iCloud Private Relay. Thank you Apple!