I used some clumsy language, I mean it acts sort of like a split tunnel in that it encrypts Safari while leaving other apps alone. The messaging apps have their own encryption.
It does forces DNS over HTTPS system wide but with a NextDNS profile that is happening anyway.