It's all thanks to OPNsense and its solid plugin support ...
You could block outbound DNS at the router/firewall, or conceivably transparently proxy it there. If these don't sound easy to you (and I'm guessing they don't, I don't know if anyone has even written ...
Everyone uses Cloudflare's 1.1.1.1, but 1.1.1.2 is the one that actually protects you ...
I've always ended up needing to install something like openwrt on my routers. I'm not particularly interested in continuing to need to do that as this seems like an obvious feature people might need ...