Serious enterprises already manage all their endpoints directly, and control their DNS configurations. For that matter, they also run edge TLS proxies and push internal certs to all their machines, so they control HTTPS egress as well.

There are a couple security products that rely on monitoring DNS to function (the "passive DNS" products), and if you're one of those vendors, an industrywide shift to DoH is a real problem. But for everyone else, it's not so much a problem. The same enterprise people raising the alarm over DoH are the ones who tried to break TLS 1.3 to keep the non-forward-secure RSA handshake in the protocol, so their TLS sniffers would keep working. They adapted.