Interesting (kinda) coincidence. I've just switched from Android back to iPhone, after about 10 years away from the platform.
But I use an always-on Wireguard VPN back to my home network, with my DNS set to my Pi-hole servers and my firewall rules blocking access to all external DNS servers, except from my Pi-holes for upstream resolution.
I'm yet to do some p-caps to see what I'm missing in this setup - while I'm confident it did a great job of protecting me from a lot of Google's data-harvesting shenanigans, I'm yet to investigate what I need to do to achieve a similar outcome for my iPhone.