Another way of expressing this idea is that the new address would be a secret known only by the wallet daemon, and the particular client program that asked for it and whoever or whatever the client program shares it with presumably whoever is being asked to pay.
Perhaps some of you know of several wallets that already do this.
Wasabi Wallet has what you are looking for. Here is the documentation: https://docs.wasabiwallet.io/using-wasabi/RPC.html
This is a solved problem: When you use BIP39, you only need to keep a single backup of a 12 word seed in order to generate an ~infinite number of new addresses.