Secure DNS is a "same-provider DNS-over-HTTPS upgrade" approach, and it sounds like you're conflating it with a different design, where Chrome would talk to Google-run DNS servers?
(Disclosure: I work at Google, speaking only for myself)
Whether this is because the entire Internet uses Google Analytics, Gmail, etc, or because they have a different more effective way of tracking DNS queries is irrelevant, since they always manage to find a way due to being omnipresent.
In theory, DNS-over-HTTPS in Chrome allows Google to bypass OS-level ad blockers. Just like Manifest v3 limits the capabilities of in-browser ad blocking.
Let's take a trivial example: everybody has their own router at home, typically with the address of the DNS server visible in the local network as the address of the router, and their computers are seeing only that address.
If Chrome would keep that, nobody's router would "provide DNS-over-HTTPS" and nothing would happen. That means that Chrome will try to avoid using the router as a DNS, and instead try to "guess" if the local router is "changing something" or "using a provider" (whatever they define as that). And then the Chrome will contact that guessed provider.
As far as I understand, exactly the only device we can fully control is being actively avoided, and instead some "guessed" provider is contacted using HTTPS.
So what is actually going on there?
I'd like a honest technical description.
That's not my read of the design doc [1] or code [2]. Instead, it looks to me like if you have your DNS server set to one of a hardcoded list of IPs known to support DoH then you get upgraded. That list is currently 8.8.8.8 (Google), 1.1.1.1 (CloudFlare), 9.9.9.9 (Quad9), and their aliases. If your DNS server is set to 192.168.0.1 or something, then this change will have no effect for you.
[1] https://docs.google.com/document/d/15Ss0OaJeb-T3g2RMwgikHvsC...
[2] https://chromium.googlesource.com/chromium/src/+/b0436911ed6...