Point 2 is that if I for some reason don't trust Cloudflare to protect my users' privacy or provide speedy service or hey, maybe I just don't like the fact that they carry traffic from a bunch of seditionists -- whatever -- then I have no easy way to say to Firefox: Don't Use Cloudflare, use my provider who I do trust.
I don't care what sites my users are visiting, so inspecting their DNS traffic is not something I need to do (although perhaps it is for certain enterprises). The central point is that I no longer get to easily choose which DNS provider to trust; Mozilla has made that choice for me. That breaks the internet in a way analogous to the way AMP breaks it, and that's wrong.
I can in fact change that choice but doing so introduces a new protocol and a new set of labor-intensive tasks for the sysadmin that did not exist before, and for every app that adopts the Mozilla model, that labor increases yet more.
I get that it makes some use-cases harder, just like HTTPS made some HTTP use-cases harder (like captive portals for wifi login) but in the end it seems like a net benefit for the majority of usecases (I want the same site, securely, no matter the network I'm on), right?