I think this is way further out than people may realize. I've done pentesting in a lot of different office networks and 53/UDP is open for all, but not 443/TCP unless you're a known device.
How do you block DoH?
Technically, the provider could use something else, but are they so worried about ad blocking that they’ll run BGP anycast themselves?
Hate to say it, but invisible TLS-intercepting proxies are more widely used today than they were in the 90s.
On 443 blocking: Doesn't that defeat the purpose of having a "smart" streaming tv. If you are willing to blanket deny 443 you might as well just block the whole address and turn it into a dumb tv.
And on that note. I have set up unsecured wifi access points before and seen the neighborhood samsung tvs eagerly use it to send their nefarious spyware payload.