I imagine they must be. I'm habitually careful to either click on a link, paste the entirety of the internal URL at once, or enter only the most generic word or words that will surface the URL I want as a history suggestion - all to minimize the chances of leaking anything this way.

You can turn the auto search off

There's a lot of things that you can turn off, but nobody actually does - which is the very reason they ship turned on in the first place.