If you know the iP the DOH client uses you can intercept it. But you can’t spoof it without breaking TLS, which means deploying your own certificate

This general industry move will lead to more tls breaking proxies and more network interception. All because people don’t want to understand how a network and os work.

Making doh at the application later normal it moves the power towards the centralised advertising network and away from the individual. That the SV culture likes this is unsurprising.