Makes it more difficult, certainly. But not impossible. Most browsers and OSs' will let you choose what DNS servers to use. It doesn't necessarily have to be a DoH server.

iOS might be more secure on that front, though. Haven't really played with their parental controls.

Growing up, (in the days of dialup) my folks tried to keep me off the computer till they got home by requiring a password to boot from the hard drive. I bypassed it by using a boot disk floppy I built at school. Couldn't figure out how to get into Windows but I could still play Doom and Duke Nukem. Didn't really even know what I was doing at the time. Thinking back, they may not have know about BIOS boot passwords. If they had, then what I did to bypass their lock out wouldn't have worked.

If kids truly want to be able to do something, and it is at all possible, they will find a way. Nothing is secure if you have physical access.