Yes, but the malware isn't required to use port 53 or "plain DNS" at all... Regardless of what the OS or Firefox or whatever existing app uses, a malicious bin

Yes, but the malware isn't required to use port 53 or "plain DNS" at all... Regardless of what the OS or Firefox or whatever existing app uses, a malicious binary could just use DoH, or just make an HTTP request directly to an IP, or skip HTTP/DNS entirely and fling data out over UDP to an external IP. Put another way: if your issue is that DoH removes your ability to catch DNS requests from malware, your issue isn't with users enabling DoH, or with app devs defaulting their apps to DoH, your issue is with the concept of non-DNS network protocols. Even if DoH was never standardized, an attacker isn't required to make lookups on port 53 as you desire.