I'm curious as to which router/modem you have that offers "secure DNS". In the UK the router acts as a DNS cache and then connects to Vodafone's DNS servers. These servers (and those further upstream) can be connected to using DNSSEC*, so I would assume this is being used. Passive use and reporting from such tools as DNSBench suggest that at least here in the UK, DNS lookups don't use DNS over TLS (DOT). The problem with secure DNS is that no matter how you manage it some online service/company managing that DNS or your connection can always see your DNS look-ups and the sites you visit -even VPNs just move this ability to a third party. I would suspect that using Vodafone's DNS servers is as secure as you are going to get since your first-hop requests never leave networks managed or at least directly connected to Vodafone (and they're quick too). My experience with a Vodafone router is that it supplied the (single) suggested DNS (router cached) through DHCP queries and there was nothing to prevent you specifying different DNS servers through the settings on your own devices, or even changing the DNS servers used on the modem/router. The router does not "enforce" the use of VFs DNS server.
*Linked definitions supplied from Wikipedia - even so always check your sources before clicking.
**All opinions here come from passive observation, things may change with time, and don't try to hack your ISP!!! ((Mods feel free to modify that last piece if you can express it better))
