For #2; I would think you could reasonably disable sending ICMP port unreachable (possibly for UDP only) for these machines. Or at least for the IPs they use for sending queries.

It's not strictly required, and leaks information. I don't know what an dns server would do with an icmp unreachable to its reply anyway.

Random drop would work too of course. I think there's a general concern about these rate limits leaking information, but it's hard to address because of many concerns. Alternatively a big push to use lots of IPv6 addresses would increase the search space and make it harder to spoof (contingent on IPv6 support in authoritative and recursive severs and their networks)

I had the same first impression, and it's not like ICMP unreachables weren't already a security issue (they're how you do UDP port scans in the first place). I assume there's a reason they're kept enabled. But you could keep them enabled and approximately 100% functional while breaking this attack just by dropping a couple now and then.

Your first point is yet another reason why setting up a PiHole with DoH is an excellent idea, beyond privacy and ad removal