You are missing that also meta data such as the connected host, the time spent on a connected host, time of access, data volume transferred etc is also valuable. Also, they know the subscriber pretty well to begin with. Also their location.

Also, lots of sites are not encrypted, still.