Tell me where I'm wrong or misunderstanding here: If you consider DNS analogous to HTTP, then DoH is TLS and the DNS provider is the CA (the org you need to trust). Your objection is that you can't modify protocol traffic since there is now an authority out of your control. It seems to me like it increases the security of the user since the network operator can no longer modify the traffic that the user requested.

I get that it makes some use-cases harder, just like HTTPS made some HTTP use-cases harder (like captive portals for wifi login) but in the end it seems like a net benefit for the majority of usecases (I want the same site, securely, no matter the network I'm on), right?

The DNS provider is not analogous to the CA. Remember that the CA only certifies that Cloudflare is in fact the Cloudflare, and not Joe's All-Night CDN and Lotto Ticket Dealer. The CA does not vouch for the ethics of Cloudflare, just like the CA does not vouch for the ethics of Google. So that's point 1.

Point 2 is that if I for some reason don't trust Cloudflare to protect my users' privacy or provide speedy service or hey, maybe I just don't like the fact that they carry traffic from a bunch of seditionists -- whatever -- then I have no easy way to say to Firefox: Don't Use Cloudflare, use my provider who I do trust.

I don't care what sites my users are visiting, so inspecting their DNS traffic is not something I need to do (although perhaps it is for certain enterprises). The central point is that I no longer get to easily choose which DNS provider to trust; Mozilla has made that choice for me. That breaks the internet in a way analogous to the way AMP breaks it, and that's wrong.

I can in fact change that choice but doing so introduces a new protocol and a new set of labor-intensive tasks for the sysadmin that did not exist before, and for every app that adopts the Mozilla model, that labor increases yet more.