That only works as long as you can easily distinguish the DNS traffic from the rest, right? For instance if my VideoApp serves content from videoapp.example.co

That only works as long as you can easily distinguish the DNS traffic from the rest, right? For instance if my VideoApp serves content from videoapp.example.com and I use my own DNS also at videoapp.example.com, served over DoH, I think that's basically the end for host-based content blockers.