You where talking about “system wide AdGuard”, which is not the browser addon, but an app that uses DNS blocking, be it by either letting people set DNS servers manually, or automatically through VPN. Their VPN does not break TLS connection by inserting custom certificates and MITM proxies, so they cannot read/modifiy content.

It might be possible to use TLS breaking proxies for systemwide ad blocking, but even that wouldn’t help, because nowadays a lot of content and ads are loaded dynamically via javascript. So a browser is required to filter ads.