To add to this, you can install AdGuard Public DNS mobile config file, and tweak it (via profile builder on their website) to add family protection and change from just a pseudo VPN to DNS over HTTPS, TLS + add Wi-Fi networks for it to ignore automatically and exclude some domains.