Sure, the web server SHOULD... but what if it is misconfigured? Or doesn't have an option to properly validate the Host header?

This is an internal client using an internal IP address to communicate with an internal service... just so happens that a malicious user made the internal client talk to it maliciously.

DNS rebinding attacks being stopped by the resolver are a great place to start and something we can do. Bypassing that protection in the name of resolving using DoH just means you've made things less secure.