Just a quick reaction for now.

Could Knot Resolver accept queries from source port 53 by default, as RFC 5452 allows ?

I'm not inclined to do it (by default, immediately).

The source IP+port are easily spoofed.  If it's 53, attackers can choose e.g. an authoritative DNS server's IP, so your resolver sends reply to an authoritative server - as it's correct IP+port, it will get delivered to the daemon - which may or may not react by sending an answer back to you.  While a loop doesn't seem likely with decent SW on the other end, I believe the low ports would increase the potential for reflection attacks.

But it uses an internal structure, so it may not be safe for future versions.