But not everyone has their system set to use the DHCP's DNS, and browsers/some devices override that with some other public DoH provider by default (or as an option)... and not allowing that would break too many people's access IMO.

I feel like a simple IP block/whitelist for the messaging service would be so much easier than all this SNI business. There's nothing stopping them from verifying specific SNI certs against the real ones anyway if you went the xray route.