DoT/DoQ is easy to block since it uses a specific port - 853.
by default. but they can use different ports.
DoH, just block traffic to known providers by IP or SNI. There you go, secure DNS defeated.
then a thousand DoH services pop up, or your friend runs one for you, or whatever, and they won't be able to find all of them. just like streaming companies can't completely block all VPN providers either.