DNSSEC doesn't really protect you at all here. The last mile between you and your recursor has no DNSSEC protection at all (DNSSEC is server-to-server). There are a whole bunch of other places to redirect your traffic before and after name resolution. And, of course, DNSSEC offers no privacy whatsoever: any ISP MITM can still see every domain name you're looking up, because DNSSEC is a signing-only protocol.