Not just CDNs, ISPs can certainly operate their own DoH servers on their existing DNS infrastructure. If they want to continue selling their users' browsing data to marketing firms, that is what they will have to do.
This also moves trust to the browser and OS TLS certificate stores, which may be problematic depending on your opinion of whether or not you can trust every single one of the governments and organizations behind the hundreds of root CAs.
I am using DNSCryptProxy on a Pi and it fully supports DoH + eSNI even without cloudflare. Works perfectly with Firefox.
The service picks from 65 DoH servers based against the fastest ping time.
That was/is a lot better than before when in reality my only choice was my ISP DNS. In fact I just learned for the last few years that my ISP was hijacking all DNS requests anyway.
I agree that due to social issues the problems are fairly real (ISPs ain't gonna do shit). But on a purely technical level DoH should be fine.
But it seems like none of them have done that. Maybe the policy terms are objectionable? Let's see:
"Only aggregate data that does not identify individual users or requests may be retained beyond 24 hours."
But how will the poor ISP make extra money selling DNS query information?
"When a domain requested by the user is not present, the party operating the resolver should provide an accurate NXDOMAIN response and must not modify the response or provide inaccurate responses that direct the user to alternative content."
An ISP that obeys this can't put up advertising banners or sell search engine redirects when you typo a name - they'll have to actually earn money providing Internet service instead.
Also it is questionable why a free service would be better then a paid one. If one assumes that the ISP is evil, DNS providers are not suddenly less evil.
Mozilla isn't suggesting you choose services based on how cheap they are, but on whether they implement these policies.
NextDNS, who are on Mozilla's list, offer a paid service if you want advertising filters or porn filtering or whatever but if you're damn sure you "get what you pay for" then pay them their subscription fee and don't switch on any filters.
Mozilla doesn't know if they do. They can't verify it. So if Mozilla says "Cloudflare and Nextdns adhere to our policies" it's not verifiable by me and neither by them. I don't see a "trust but verify"-implementation. This is my gripe with this behaviour.