I don’t think so. Instead you would want DoH (dns over https). DNSSEC is designed to protect against MiTM and is not really effective at anything else.
Fair enough. Cloudflar's promotional site for 1.1.1.1 seems to tout DNSSEC pretty heavily and only mentions DoH once, I believe.
Still, clients still need to be configured for DoH, yeah?
Correct - third party software is needed (as far as I know) for DoH.
You do need client support but these days that’s not uncommon: Android Pie, Chrome, Firefox, and curl all have built-in support and there are apps for iOS and Android, and once you’ve enabled it it will work almost everywhere. I believe most clients default to dual resolution so it won’t break if you’re on a network which interferes (e.g. a ton of Cisco captive portals used that address in error) unless you’ve enabled hard-fail mode.