That one can be bypassed by using an own DNSSEC or DOT DNS provider I think.

This makes "compliance" captive portals even more annoying... in Germany, every public network has one, so that people accept that they are not responsible for whatever and log MAC addresses and whatever.

This requires to use DHCP advertised insecure DNS, great!