The fact that there is no readily available information to support your conclusion, should give you some idea about its validity.
The point is, that if your attacker is already in, he will need to do some additional foot-printing anyway. Your host name may be
database.xyz.intranet, but if the nmap gives you 1521 (oracle), 1433 (sql server) or 5432(Postgress), that gives some information about possible vulnerabilities.. Sure, it will save some time knowing that
www.companyname.com is probably not the back end database server, but that is minimal.
On the other hand: are your developers really happy to do SQL-queries on
linux20195681.intranet? What is they fire-up a second database in your on-premises cloud? Giving some meaningful names simplifies their life too. And of course it easier for the stand-by that is called at 2 a.m.
Also, your real servers may be hidden behind a load-balancer. The VIP would then typically get the functional name and the hosts behind it some sequence number.
If you are in a small organization, you could consider giving your hosts themed names (e.g. my Pi's at home are called pi, rho, sigma, phi, etc.), but even then, I struggle to remember that sigma is my home-automation, psi my DNS server etc. And yes, you might theme Zeus as the production database, Jupiter as test and Odin as develop, but at some point, any form of polytheism will put a limit on the number of servers.
So it really is better to give them functional names.
On the other hand: don't be to specific or alluring. Calling a host
privatekeybackup.intranet will surely attract a bit more attention.
There have been some ideas of randomizing host names (rfc8117) but that seems more an issue for clients.