> 1) By default, every word (each character, actually) you input into Spotlight/Siri gets time-stamped and sent to `smoot.apple.com`

Huh? How do you expect Apple to show live search results if they don't send what you're typing to their servers?

> 2) Even with a Pi-Hole blocking *.apple.com (i.e. using MacOS >> Networking >> DNS Server), on boot all modern Apple Silicon reaches out to security.apple.com (i.e. bypassing the user's manual-input DNS setting), using the DHCP-issued DNS IP [0]

From a quick google search, it seems to be if you enable "Find my" or pass word recovery with an Apple account. I think that's reasonable to expect if you enable these features.