DoH is malicious imo, there may not be any truly private providers (as you mentioned nebulo). The default ones or ones at the top of most recommendations are all 'a bit off'.
Seems like another monetization scheme, mozilla even made a deal with usa isp comcast.
Interesting reddit thread relating to it:
https://old.reddit.com/r/pihole/comments/ig47hz/multiple_apps_including_tiktok_use_dnsoverhttps/
Biting the hand that feeds IT
