

People need to stop spreading this. It’s false and it’s dangerous because it presumes a basket of things that isn’t. It is incredibly easy to identify commercial VPNs meant for anonymity, skipping geo-blocks, torrenting, etc and separate them from those used for secure access to internal networks. For starters all traffic has an address. Those commercial VPN providers used easily and quickly identified servers for which off-the-shelf weekly/daily updated lists of IPs can be purchased from commercial companies. There are other things like traffic analysis but it’s frankly not necessary.
If the UK or the US wanted to block commercial VPNs entirely they could do so very easily. China and Russia have no interest in running no-logs VPNs for westerners to escape their censorship regimes and put in that kind of effort as the west has put into their own VPNs and solutions to enable “dissidents” (CIA provocateurs and liberals) to communicate. People single out China because they can’t block all VPNs, well the GFW designer said it isn’t meant to stop everyone just introduce friction so anyone who does so has to have gone against the current and hopefully knows their stuff. The technical means of doing so which the west has isn’t even getting into their control of the world financial system, they can seize bank accounts, arrest the people running these services, sanction and fine the hosting companies in the west for hosting them, deplatform them, etc. And the problem there is that the anti-west: China, Russia, etc are not interesting in hosting this stuff for westerners outside of western jurisdiction.
DNS adblocking is part of a multi-layered defense strategy. It’s defeated by ads being served from the same domain as content. I know that more advanced options like pfblocker allow interrogating “fronting” subdomains to detect those that resolve to an ad-server (e.g. funstuff dot domain dot net actually resolves to eviladtechcompany dot ai) and block them as well and that helps a bit but the best defense is having on-device blockers as well.
There’s also a lot more ad tech companies that rapidly deploy domains and subdomains to attempt to overwhelm ad list maintainers and they often succeed for a time in a real back and forth battle.
It’s also possible the goodreads app has hardcoded secure DNS servers (that don’t use the standard DNS port but often 443) that they use to bypass DNS blocking by resolving their ad domains themselves. In that case you’d want to implement a firewall list of the biggest DNS resolvers (for example like this list here I found with a quick search) and prevent any traffic from within your network from reaching them by either dropping or blocking. Importantly you want to ensure that your DNS resolver can still reach the root servers or whatever you’re querying but any other device should be blocked from accessing these. You should also be either redirecting the standard DNS port (53) to your DNS server if locally served or blocking it except for any necessary local DNS servers.