I think their point has merit. It isn't don't use DoH, it is don't use DoH outside your network and outside your control as it has been/can be exploited by 3rd parties. CISA, as the article points out, made the same argument, it isn't that DoH is bad, it is that a 3rd party DoH provider can actually do malicious things hidden from the IT admins and staff, making identifying a malicious endpoint the user was served via DNS harder.

I am not above thinking any government agency might put out disinformation to protect a source/access, but this one seems like a reasonable position to take on security.