Honestly, I don't see why people keep bringing this up. Malware has millions of ways of creating covert channels and you will never be able to block/detect all of them. It's also well within the capability of major DoH server operators to detect and shut down malware domains pretty fast.