How is that protected by TLS? Wouldn't you need a good A/AAAA record to make a connection to a TLS server?

Or do you perhaps mean DNS over (TLS|HTTPS)? I never saw that as a complete replacement for DNSSEC; it provides transport security, yes, but how do we know we aren't talking to a malicious resolver? Maybe that's not as much of a threat if people aren't using DNS servers from their ISP -- which sometimes inject ads or otherwise tamper with traffic.