I feel like I have gathered enough information, so I'm answering my own question.
Let's say there are two scenarios of user flow:
www.example.com -> dogtoy.example.com -> www.example.com/thank_you
www.example.com -> paymentsite.com -> www.example.com/tahnk_you
In both scenarios, tracking code is embedded only on pages under www.examples.com.
I shouldn't stress out too much because Google Analytics (GA) will handle both scenarios pretty well.
According to Google Analytics Help page:
Visits represent the number of individual sessions initiated by all
the visitors to your site. If a user is inactive on your site for 30
minutes or more, any future activity is attributed to a new session.
Users that leave your site and return within 30 minutes are counted as
part of the original session.
Two domains, dogoty.example.com and paymentsite.com, are indeed referral sources for traffic coming back to www.example.com. However, GA ignores the referral sources as long as a visit is still open (i.e. session cookie is not overwritten).
Therefore, credit is given to the original referral source which brought a user to www.example.com in a first place.
Unlike traditional GA, Universal Analytics (analytics.js) does not ignore referral sources like traditional GA (ga.js) does. However simple settings on admin page will take care of the issue.
Universal Analytics usage guideline states:
By default, all referrals trigger a new session in UA. For example, if
a visitor is on your site, leaves but then immediately returns, this
visitor has logged 2 sessions. You can, however, modify your tracking
code to exclude all traffic from specific domains as referral traffic
with the referral exclusions.
For understanding a concept of how GA tracks traffic, this page was also helpful.
How Visits are calculated in Analytics