Getting people to add another device like a Pihole or a separate router with better filtering capabilities isn’t going to be an option that most people can hand

Getting people to add another device like a Pihole or a separate router with better filtering capabilities isn’t going to be an option that most people can handle by themselves. This solution would definitely not work for DNS Over HTTPS (DoH), which I’m guessing will soon become prevalent in many devices. It also seems like DNS Over TLS (DoT) isn’t going to get as much traction exactly because it’s easier to block. As other comments have said, (for those who’re able to do it) not configuring any connection for the device sounds like a good start, but even that has caveats about the device connecting to nearby open networks. So the best thing to do instead is to connect it to a network but not allow any communications to the Internet.