I would just block the DoH used by Firefox, but at the moment, nobody has really proven out the DoH/DoT solutions in the OS and browsers. Until such a time that users are made aware and given choices from both their OS and browsers, I choose to treat all of them as hostile in my own home network. I see the users as frogs in luke-warm water. Both ISP's and centralized DNS providers can choose to boil them once critical mass is reached. Some ISP's have already boiled some frogs, but this is limited to specific ISP's and specific countries. The DoH providers are in a position to boil ALL the frogs globally once everyone has forgotten about DoH and/or critical mass is reached.

At work, we already control these settings in the browser and can easily control any future settings in the OS so it is not an issue there.