Of course you can just drop a rule blocking the IP address on your firewall, which will probably work for a while.
You could make the exact same kind of argument about widespread use of HTTPS for example. Do we want to allow encryption technology if it means the enemy can use it too? As a society we have agreed that encryption is a net positive even though terrorists and criminals benefit from it, but when malware uses it then that's too far?
That doesn't hold up under scrutiny. My pihole blocks ~11% of domain lookups (blocking 1000 queries per day for our household), turning it off vastly increases the unwanted content. It might seem is logical a ready hurdle, but it's a hurdle that practically works.
I don't follow the reasoning that says this is a small barrier to malware so we'll remove it.
What are we, end users, getting out of routing all our domain lookups to Cloudflare and ceding control of filtering?