I have used NextDNS for my entire network, with different profiles for different devices, and setup to work away from home, for... 4 years now? At least 3. I pay for the premium plan but the only difference is the number of queries you can have (and thereby filter). One device can definitely stay below the free threshold.
I looked at AG when researching but didn't like the offering for some reason, don't recall what exactly. When I went from testing to full use I had to get the paid tier as we use checks 3,848,010 queries in the last rolling 30d. Free limits you to 300k/30d.
I'm unaware of the options for AG, but ND is really nice. And the multiple profile system is 👌. Dial in the settings for devices/users to keep my network, and therefore their devices, as safe as I can, punching holes as needed only for that device/user.
(I'm also the type of person you talk about - I use two layers of DNS filtering (router, then ND), use snort on the router, I run GrapheneOS, all my cloud data is on-prem with hardware I own, my main server uses encryption at rest for almost all data, and off-site backups are encrypted in transit and with seperate keys at rest... :p)