There are a bunch of settings for each app, they default to on, and you h ave to navigate to all of them one by one to turn them off.

And of course, I'll bet all your data was mined before you turned things off.

does this seem user-friendly? seems deliberately hostile to me (though par for the course nowadays)

Yes. DNS can be configured once and it's done, whereas having a setting that gets reset whenever an app gets (auto-)updated is treacherous.