Barry says they don’t do DNSSEC verification at all and that ControlD is made to work like that on purpose. That means users of plain DNS are completely unprotected from DNS manipulation so it’s definitely not recommended to use this on older routers as well as devices that don’t have DoH/DoT support.
The one thing that also caught my eye on that Reddit post is “It’s also not compatible with a DNS resolver that manipulates DNS records”. AdGuard Public DNS, NextDNS and all other DNS servers use same blocklists and still verify DNSSEC records without any issue.