DoH and DoT encrypt the client's connection to the resolver, but they don't always verify that the response is from the authoritative server. That can be done by DNSSEC, and is often taken care of by DoH providers (e.g. Google and Cloudflare) but only if supported by the authoritative server.