Varnish is also locking DNS-based lookups behind an enterprise flag.

I have but only briefly. I needed a pretty high degree of customization for my use case so njs for scripting was a huge value prop over having to do everything in VCL.