have to have PiHoles and other DNS sinkholes for a basic protection, which is hard for regular people
mullvad's free dns. free for all, not just their subscribers. encrypted doh or dot only. a basic ad and malware blocking dns sinkhole is a fairly simple configuration away if your os supports it (win11 and android do.. those are what i've set it up on for others so far).