> I think the ads are encrypted end-to-end from amazon-ad server to stick, using likely the same channels as the regular video content

I don't think they even need to encrypt them. IIRC pihole is just a DNS blocker essentially. All they have to do is serve them up from the same domain and you can't separate the wheat from the chaff any longer with this method.