Definitely this. Also lots of weird hardware/software out there that tends to discard packets it can't understand (i.e. this doesn't look like a DNS packet goi

Definitely this. Also lots of weird hardware/software out there that tends to discard packets it can't understand (i.e. this doesn't look like a DNS packet going to port 53, let's drop it.) 443 generally works as it is expected to be encrypted by most middleware. I would also say that most DNSCrypt-capable providers I know of can also do it on port 53.