Theoretically you could domainblock known DoH servers that certain applications would use.

But yes, I believe that if an application try hard enough there are ways to bypass any set of rules you set on a device. Luckily, most applications just use the internal libresolv for any domain resolving needs.