Network settings won't save DNS servers
Turned out to be simple - my DSL router had DNS servers configured, and those were overriding the settings in the Network Control Panel due to DHCP being used. DHCP was grabbing the servers from the router and ISP.

So I changed DNS servers in the router, restarted the router and the Macbook, and then could see the 1.1.1.1 and 1.0.0.1 servers in the Advanced>TCP settings; they were grayed out since they were set in the router.