This is largely incorrect. SNI is used to tell the server which domain it needs to send a certificate for (i.e. to securely prove it owns that domain). You are

This is largely incorrect. SNI is used to tell the server which domain it needs to send a certificate for (i.e. to securely prove it owns that domain). You are right that it is separate from the HTTP host header, but in practice they are always the same because (in lieu of other information) the client wants assurance that the server owns a valid certificate for the HTTP host it is requesting to. What makes SNI complicated to secure is that until the client has securely established the server's identity, it could be a MITM. But to prove the identity to the client, the server needs to know which proof the client needs. Alternative solutions like "send certificates for all domains" have other issues such as performance, scalability and trivially leaking to anyone the full list of domains served. ESNI is clever, but more complex to deploy. It's only in recent years that HTTPS has become widely used at all, and that's mainly thanks to deployment becoming largely trivial via ACME and free via Let's Encrypt.