LOL. Several of the large ones are owned by the same entity.

The main reason they exist is to do grey market bypass of controls becoming media access. If you trust them to not do some grey/shady exploitation of your metadata, more power to you. Sounds foolish to me.

Yes, I was using a bit of hyperbole.

But that said, on this point I do agree with the author: privacy improvements from using a VPN are marginal for the average user due to the now widespread use of HTTPS. Yes, your ISP can see which domains you visit, but that's about it. I'm curious if there have been any successful lawsuits or prosecutions based solely on domain access logs.

Unless you're using DNS over HTTPS or DNS over TLS. Then they can't.

Side question: Anyone know of a gateway or self-host service which supports DNS over HTTPS relay?

i.e. it will accept vanilla DNS requests, but if it needs to forward requests, it will only do so to DoH / DoT servers?

They can still deduce it from the TLS SNI unless the web server you access supports TLS 1.3 Encrypted Client Hello. https://en.m.wikipedia.org/wiki/Server_Name_Indication

I do that with pihole.

I absolutely despise my ISP’s business arm, but I trust their network arm not to do something stupid. I certainly trust them more than a company in a remote tax haven with a broken legal system.

Sweden and Switzerland are hardly 'remote tax havens with broken legal systems.' you don't actually prefer your ISP's DNS service over something like say, Quad9's, do you?