Fedora and fallback DNS servers

1.1.1.1 and 8.8.8.8 and similar aren't "effectively owned by someone else". ISPs (of their own accord or by government mandate) could decide to blackhole these addresses but they can't impersonate then because the underlying services offer TLS and of course have certificates for their own names.

Apparently everybody in this thread pays a lot of attention to their DNS configuration and so I'm sure everybody here is using TLS right?

The British government's old white paper (before it was repeatedly back burnered and effectively scrapped) described DNS based filtering censorship as the practical way forward. I remember reading it at the same time IETF 101 London happened, I remember because of the irony.

At that point what is now "Encrypted Client Hello" was only a napkin sketch, but DPRIV and TLS 1.3 were essentially done. DNS-based filtering was thus a dead man walking. Fast forward three years, it's irrelevant. If your teenager wants to read Oglaf then an ISP filter won't stop them.