OP here. Pi-hole was designed to run on a home network, so the DNS service is wide-open to everyone. The admin panel is also listening on the same interface as the DNS server. Even unauthenticated users can access the web panel and view some basic stats without logging in.

The general recommendation is setting up OpenVPN (or similar) and make Pi-hole listen on the tunnel interface.

Luckily, the Pi-hole project is publishing a guide for this: https://github.com/pi-hole/pi-hole/wiki/OpenVPN-server:-Setu...

When/if you use mobile data it will probably ignore it anyways.

I've used a hosts file for a while (MoAB) but it was a pain whitelisting because you have to edit the package. reboot your phone and reinstall with adb. However, when using mobile data my phone totally ignored the hosts file.

Yes, see http://gomez.wtf/set-up-a-cheap-cloud-hosted-adblocker-in-an...

I have running it there ... http://adsorb.me/ I didnt finish the web yet, but you can use this DNS

Be careful of open DNS servers being used in amplification attacks. My previous internet-based Pi-hole server got flagged for this.

I know it's not exactly the same thing as having a self-managed PiHole, but Block This does something very similar and can be installed on any Android device: https://block-this.com/