Unless you're running your own local DoH server, it's just privacy theater, and not even good theater. It's the same bogus argument made in favor of retail VPNs. "Encrypt your traffic so your ISP can't spy on you!" Meanwhile failing to recognize that you're just moving the spying agency to some free service owned by--oh, let's look at the top providers... Cloudflare (not great), Brave (advertising company), Google (Bad)... Need I go on?

Perhaps you've forgotten that old adage: if you're not the customer, you're the product.

I run a local DNS server that has its own blocklists, internal DNS records, etc. I imagine most people who might bother to deploy an enterprise browser policy do something similar.