That was very useful. I could reproduce it in 8.5.3 up to 8.6.2 but it seems to have been fixed in 8.7.0. I am afraid in order to fix it you will need to upgrade to 8.7+.
The issue was fixed in lucene here: Fix exponential runtime for Boolean#rewrite by benwtrent · Pull Request #12072 · apache/lucene · GitHub
And probably was introduced by some optimisation that combines the query and the terms aggregations to avoid visiting all documents.
hope this helps.