If Apple is serious about customer privacy, they should provide a DNS server with DNSSEC functionality and implement DNS over TLS and ECH at the OS level. If they can't do that, they are just another shady "ad agency."