And now they have a one-stop shop for all their DNS surveillance needs.
There are a few dozens of DoH services out there [1] and nothing prevents anybody else from running their own.
DNS is the most openly insecure aspect of the entire internet. It’s wide open.
2) to implement this canary, you have to break DNSSEC on entire .net root domain. Great.
That's an intentional design feature. You're attempting to intercept traffic, and any mechanism you could use to do so "transparently" could be used by any hostile network to do so.
You can still intercept traffic from cooperating devices if you want, just not transparently. That's a feature, not a bug, and the Internet will be better for it.