All this assumes though that the devices can be configured to do that. While that's likely for browsers, it's less likely for smart TVs or other IoT devices, especially if you don't trust the devices in the first place.

(Edit: removed bit about root CA certs because I misunderstood)

The Chromecast in particular defaults to 8.8.8.8, ignoring your DHCP-assigned DNS servers.

I've completely blocked any outbound traffic to 8.8.8.8 and 8.8.4.4 from my network.

how about setup iptables to forward all DNS traffic to self-hosted Pi-hole?

if the certificates are pinned, you're screwed. Even if they aren't, it's a matter of luck if your smart$thing accepts self-signed certificates for $thingsdomain.

This is why you don't buy proprietary spyware hardware.