So this is a system-wide DNS hijack for the purpose of filtering and monitoring?

It shifts DNS from Default Allow to Default Deny. AD DNS should have had this two decades ago.

So say an attacker can enable this service

If an attacker has already penetrated your Network Infrastructure to the point that they can setup ZTDNS you’ve already got problems so serious that DNS over TLS with DNSSEC is not going to save you.