Your ISP routes all your DNS lookups anyway, so they can see what they are even if you don't use the ISP's DNS server.

They get to see every single unique name you look up, they just don't get to see how often you do it if you use a caching resolver.

You'd need to VPN to somewhere else in order for your DNS queries not to be visible to your ISP.

This is not correct anymore since dns over tls. Well most routers do not support this yet, but its possible within your distro.

AFAIK you can't recurse using dns over tls. You have to use a provider such as google/cloudflare, at which point you're back to square one.

You still need to talk to upstream servers at some point.

Indeed, but much less frequently.

True. Using DNS at all means trusting one of the root servers at some point.