What about it? If you can't trust it, you can't trust it. You either control it, don't control it and don't care, or don't control and it's a moot point. Nothing you deploy even needs to use "real DNS" to look things up; it could just set up a TLS channel with an IPv4 rendezvous.

The idea that everyone else should have to use a DNS transport that ISPs can filter to downgrade back to being snoopable just so you can feel better about what your Chromecast or Amazon Stick or whatever does on your network doesn't make a whole lot of sense. I don't mean to put a bunch of stuff on you that you didn't say, but this is a very common pushback to DoH, and it makes no sense.