I believe it is client-side. I did try this with my iOS 15.0.2 phone using the stock Mail account. There is no way that I could find to add the hidden address as an account.
Bad news, though; I did a test mail from a secondary email account, then replied to it. When I checked the headers on the reply, the actual email address was exposed in the headers. (My Apple ID is a gmail account; perhaps an iCloud mail address Apple ID would be different.) The reply-to address was the hidden iCloud address, but looking at the full headers showed the real email address.
Though I do have a separate Apple ID that uses an iCloud email address, I don’t have an iPhone or iPad set up with that address at the moment. When I install Monterey I’ll check it there on my secondary account and see if the same thing happens.