You don't. When the device manufacturers start being really evil and using certificate pinning for their DoH servers you simply don't buy those devices.
When the only devices available in the market for a given function end up being "evil" you either implement the functionality yourself or you just live without.
It's that or legislation (which will just become an arms race of manufacturers trying to work around the legislation).
I do without. No "smart" devices for me or my family. It's working so far. I about the eventual future when no major appliances, vehicles, etc, will be available without "smart" features implemented in an owner-hostile manner.
This removes a couple of avenues of attack you might have used to rein in some of those devices (but probably weren't doing), but it's just a symptom of the fact that using DNS for device control was always a really hacky, kind of awful solution to the problem of having rogue devices on the network.
Plus, right now we're talking about a browser adding DoH, and not some shit Google or Apple browser that makes the decision for you and it's final, but a fully configurable, user controlled, poweruser enabling browser that lets you modify its core behaviour without even having to recompile it yourself. You just open a tab and flip a boolean.
There is no problem.
How do I enforce that? How can I ensure that no javascript payload or "smart" device on my network or app on my phone is connecting to a DoH server, when they're on my home network?