Cloudflare's malware blocking service is my go-to. 1.1.1.2, supporting DoH and DoT. I prefer them over Quad9 because Google blog post listed several malware domains and Quad9 only caught half, while Cloudflare caught them all.
https://www.reddit.com/r/Quad9/comments/t9b9v1/quad9_not_cat...
I think WARP is a great value proposition for the use case of avoiding ISP sniffing. I use Firefox Private Network which leverages WARP, and as an added bonus, does not disclose my IP (unlike plain WARP).
I believe Mozilla's contract with Cloudflare to provide Firefox Private Network provides great value, and I've been happy with it service for quite some time. Mozilla and Cloudflare are both well known organizations, and Mozilla acting as a buyer's agent is a good position to be in.
https://pypi.org/project/datar/