I have researched Oblivious DoH (ODoH) a bit and came to a few conclusions around the lack of security concerns for SSRF in the RFC. I was asked to also make a public issue about it after reporting issues in odoh-server-go made by Cloudflare.