[nawtacawp]

could setup a small firewall (pfSense) that routes all DNS queries from connected devices to your own DNS server.

[pjc50]

Not with DNS-over-HTTPs and certificate pinning you can't, because the certificate check would fail.

(That would be a very annoying thing to do in a device or browser, but it's certainly possible)

[silon42]

Exactly, the only choice is to root the device or return it as defective.