I don't know your setup but in my opinion something like proxyman / mitmproxy or even Wireshark would be the better way to analyse this.
I tested quite often and never saw the leak with Qwant.
In any case, Little Snitch is not lying and inventing packets. I don't know why you aren't seeing anything, but as I said, it's a race condition, so that can happen, and in any case, I would say that it's a better way to analyze this by adding Little Snitch to your setup.
I did: https://news.ycombinator.com/item?id=43175181
There's really no magic or mystery here. The extension is simply using this API: <https://developer.apple.com/documentation/safariservices/sfs...>