There are any number of ways to do it, the most relevant factor being that the user can choose which DNS server they want to trust, not which protocol you use.

> Because with a VPN, you need a VPN endpoint that costs somebody money to run. With TLS/HTTPS, there are no extra systems in the mix.

Someone is paying to run the DoH servers. You might also ask why they're doing so, for free, when that costs money.

> Don't domains hosting malware get seized and taken down too?

Malware often uses domains on foreign registries that are legally complicated to seize, so it only happens to the most serious offenders and can take a long time.

You also have vendor spyware which is not going to have its domain seized but is also not going to resort to Github pages for name resolution.

> I 100% agree with this. DoH only provides the former, though.

It doesn't. If legitimate applications are using DoH to a server outside of the device owner's control without providing an expedient way to make them all stop, that server can't be blocked without breaking too many things, and then malware running on the owner's device can use it without being blocked or monitored.

> Other than Firefox, what applications currently have Cloudflare hardcoded as their default DoH provider?

When someone is setting a bad precedent it's reasonable to be concerned about what happens when others follow suit.