The ship has already sailed... no one says one has to use the prescribed DoH protocol. An app could simply embed a list of known IP addresses and make custom TC

The ship has already sailed... no one says one has to use the prescribed DoH protocol. An app could simply embed a list of known IP addresses and make custom TCP queries using entirely proprietary / opaque protocols to "resolve DNS" or just discover ip addresses for their services. I'm sure many applications and devices are already doing it. Who has the time and inclination to monitor the network traffic of all their appliances to ensure they're not being spied on? I wish someone would and we'd publicly shame all the scumbags that do it, but alas...