I tried this exact setup with a combination of Ubiquiti and pihole config. It is really unmaintainable and I missed a verification / audit layer, especially for verifying that the Chinese grass/vacuum robots didn’t leak data, etc.
It would be a full time job, and then some, when the kids’ apps didn’t work due to my block lists…
Since then I have surrendered and now use a custom Cloudflare DNS endpoint.