As far as I read (I’m no expert!) they could check the SNI of the TLS handshake if they want. But using the DNS of the ISP is handing them the data right in a way they can analyze/use them very easily afaik?

Still learning about this topic!

Testing it right now and damn the results are quite impressive. But I have the same question as you, is it a good idea to use it?