> I don't see why it's assumed that every application developer will want to use system defaults

It's the user's machine not the application developer's.

And users get to decide which applications to install. Tunneling has been a thing for decades; likewise for malicious programs. Vigilance when installing programs on a networked device has always been and remains necessary.

But it’s not under the users control if they install an app- there’s nothing hard that prevents the abuse. Now if the OS had a system wide / network level proxy that checks the correct DNS calls are getting made and overrides with a user chosen default, then you’d have something.

But we don’t, we just have a default

Because, DNS, like default gateway and ip address, are configured by DHCP? Zoned DNS server for intranet is very common.