Owning (owning) your router/firewall makes this harder for them to bypass. Block all DNS outbound, allow only from Pihole (or other private DNS server), redirect all DNS to Pihole. The machines you don't/can't own will think they're reaching out to external DNS but the replies come from Pihole. I haven't dug too far into whether this works if they force DNS over HTTPS. Is that not 853/tls?! My convoluted and possibly placebo setup.
I suppose there are plenty of ways around this. My config is port based, so if they change ports or run a tunnel through something my Pihole doesn't block... Sigh. Yeah, just don't connect these crap boxes up to the network in the first place.