One of the reasons for mobile apps is that adblocking is disabled. Explains why Reddit promotes it so much. Similarly, wrapping websites like Discord or Slack in Electron also gives the website owners full telemetry and tracking that they can't get in a tech savvy browser. Would an always on VPN, a remote pihole be the only way for privacy?
I found NextDNS to be relatively convenient and easy to set up even for a lay audience. Definitely easier than a PiHole or a custom `dnsmasq` setup, and it offers mobile configuration client apps. What I do not know is if it will work also when apps begin using DNS over HTTPS… I suppose not?
ipset create blist_doh hash:ip hashsize 1024
for ip in `cat /etc/bin/blist_doh.txt`; do ipset add blist_doh "$ip"; done
iptables -A -m set --match-set blist_doh dst -j DROP -m comment --comment 'SPY:all ext DoH BLOCKED'
Still, as of 2021, doh rule is around 2% traffic logged compared to my other rule, where I simply block outgoing 53/udp (except my resolver). a LOT of your devices ignore your dhcp dns settings and try to circumvent it going directly to shady 8.8.8.8 etc.
(*) you shall every few months check and update it.