Unless you're using DNS over HTTPS or DNS over TLS. Then they can't.
Side question: Anyone know of a gateway or self-host service which supports DNS over HTTPS relay?
i.e. it will accept vanilla DNS requests, but if it needs to forward requests, it will only do so to DoH / DoT servers?
They can still deduce it from the TLS SNI unless the web server you access supports TLS 1.3 Encrypted Client Hello.
https://en.m.wikipedia.org/wiki/Server_Name_Indication
But that said, on this point I do agree with the author: privacy improvements from using a VPN are marginal for the average user due to the now widespread use of HTTPS. Yes, your ISP can see which domains you visit, but that's about it. I'm curious if there have been any successful lawsuits or prosecutions based solely on domain access logs.