What's really needed is to add support for DoH or similar to internet gateways. Attacks are nearly always between the gateway and the internet and not between t

What's really needed is to add support for DoH or similar to internet gateways. Attacks are nearly always between the gateway and the internet and not between the client and the gateway on the same LAN, and then the gateway can safely require DoH by default because it isn't a significant administrative burden to change it in one place for the whole network if that isn't what you want. They could even default to something like trying DoH to the DNS server configured via upstream DHCP with fallback to DoH to Cloudflare or similar if that fails, but no default fallback to unencrypted DNS. Meanwhile if the administrator of the endpoint device knows their DNS server supports DoH, they could still manually enable it as required even if that isn't suitable as a default there, and the default Chromium is using still protects against passive attacks when your DNS server supports DoH.