"DoT and DoH rely on you trusting the DNS resolver you're sending your queries to. They encrypt the connection, so your ISP can't casually snoop on or tamper with your DNS traffic in transit."

But _their_ ISP can casually snoop or tamper with their DNS traffic in transit

Because these third party caches (generally) still retrieve DNS data over unencrypted connections to authoritative nameservers

Cloudflare is one of the internet's largest authoritative DNS providers

This no doubt reduces the number of remote queries their cache has to send, but it doesn't account for domains that are not using Clouflare nameservers

It's worth considering why authortative DNS providers (generally) do not offer encrypted DNS

If this service exists then the www user does not need to use third party caches in order to have "encrypted DNS"