I can see why you would want to use a known-good dns provider in your product, however at the very least there should be an ability to turn off such behaviour.
It is me. My resolver does that and it is for a reason. Disrespecting what the local network tells you to use just leads to arms race.
People who buy little internet devices usually don't respond well to "it's your ISP" when their day-to-day web browsing experience is just fine to them.
If your resolver does that, you're going to be the 0.01% that complains, rather than the 2-5% that is crushing customer support.
Not saying that makes it "right", just saying it fixes it.
However, that quick fix does a damage. Why don't you use it just like a fallback. Why use it, when everything works right?
One of the most common complaints we get is that things "are slow to start" or that "I click and it's slow to respond". After long and expensive remote diagnosis, this turns out to be slow DNS, and 8.8.8.8 fixes it. Falling back to it wouldn't change the user experience.
It sucks that customization was damaged in the arms race, but that's the nature of measure-countermeasure in web technologies across the board. Every web technology is a three-edged sword: the spec, the intention behind the spec, and the real-world implementation of the spec.
DNS / DHCP implementation drifted from intention years ago.
No need to drag letsencrypt and co into the game, that's only for publicly facing machines.
(I’m a fan of local DNS for many reasons and so I think DoT is two steps forward for privacy and 3 steps backward for everything else)
With DoH, it will be more difficult, but still possible - you will have to run your own proxy. I imagine, that folks that came up pihole, will package something similar that includes proxy.
On such networks, devices that won't allow to enroll custom certificates won't get onto Internet. It is then up to the user, what he or she prefers, privacy and control or that specific product.
I actually like DoT a DoH as protocols, from the privacy point of view. However, I don't like their implementations and the lockdown they are used for, where they try to establish the tunnel out of the local networks, taking control out of their owners.
In the future, if it would need one to resolve domain names, I guess it won't get onto Internet without it, then. It was just around 30 euro anyway.
So the pihole community is tiny, but that may be the reason, why Google thinks that they are worth the sacrifice: after all, there is just a few of them.
On top of that, Virgin Media resolver managed to go offline particularly regularly.
So here we are: what user sees is that a particular device doesn’t work, while others do. So they obviously blame the ones adhering to standards.