You’re far from alone. I recently outright blocked all DNS traffic, including known DoH providers, on my network firewall for all my devices except my Pi-Hole.

Then, I blocklisted all Google and Facebook domains on my Pi-Hole… except for YouTube’s content servers so I can use Invidious.

In fact, I might follow your example and add an outbound allowlist to my firewall. Seems like the next logical step.