Rejection sampling moves the information leak from bias to time. As always don't use your own cryptography in production.
That said, there are few situations where the modulus being used is not a public parameter of a protocol, and it is very difficult to perform operations with a secret modulus in constant-time, as your comment points out.
You'll always be able to get an approximate guess of the size of the modulus too, since larger moduli will need more registers to represent data.
When developers encounter timing attacks in their code, they often invent really dumb ways to side-step the length "leaking".
This might be understandable if it was a MAC then Encrypt protocol with PKCS padding (hello lucky13), but instead this comes up in the context of "validate this HMAC-SHA256 tag for our JWT-like protocol".