I did end up setting up my new Protectli appliance today. As i said below, I ended up with OPNsense and I have been able to replicate 97% of pfBlockerNG's functionality on OPNsense. I've been able to load all of my previous DNS blocklists (including my own personal blocklists on Github), set up cron jobs (in the GUI) to update these lists every week and and whitelisted some sites too. The only thing that sucks is that regex isn't supported. Instead they do wildcard domains (*.ampproject.org). Not nearly as good as regex but it's better than nothing.

I also used pfBlockerNG for hardcoded ip address blocks (like Roku hard-coding 8.8.8.8). For that, I used the alias function in the firewall and just set up floating rules for that. Definitely not as convenient as a list, but they don't change very much. Also, for IP addresses for security, OPNsense has a whole IDS section that pfBlockerNG used to handle.

pfBlockerNG made everything clean and easy but I've been able to get 97% of the functionality in pfBlockerNG in OPNsense. The 3% deficit is lack of regex support.

Edit: I saw the article you were referring to. That's how I set up IP blocking. But Unbound in OPNSense supports blocklists (it's even called DNSBL) and that is much easier/quicker to set up than using aliases IMO. Just make sure you toggle on Advanced Mode. That's how you quickly load the custom blocklist urls. Just remember to seperate the urls with a comma. I forgot the first time and nothing worked.