The manual for the 'timeout' command makes it seem that it kills child processes if it is not used with the '--forground' option, but I can't find any explicit definition of how it behaves.
Does the timeout command also kill child processes/a process group of whatever command is used with it?
The GNU coreutils version of timeout can have its implementation viewed here.
Whether a process group is created (and killed as a whole) does indeed depend on whether --foreground is passed, as you have inferred from the documentation.
To be a bit more explicit:
--foreground is not used, we call setpgid() to create a new process group, putting both the timeout command itself and the invoked command inside that group. When the timeout later occurs, kill() is passed 0 as the PID to kill, specifying that the entire process group should be targeted.--foreground is used, only the immediately forked PID is signaled, and not other members of the process group.