"And from your IP log, they can easily get the host names if they want them."

And each IP may have multiple hostnames associated with it, requiring more work to determine which one was accessed by the internet subscriber

The VPN also has an IP log for jqpabc

If someone wants to explore jqpabc's "sensitive traffic", it's even easier than asking his ISP. Because jqpabc uses a third party VPN, we just subpoena the VPN and they start logging, unbeknownst to jqpabc

Because the VPN uses a third party DNS cache that sends EDNS client subnet and does not encrypt DNS traffic to authoritative DNS servers, we can also get logs from those servers as well as jqpabc's general location

And of course jqpabc sends plaintext SNI so we have another source of hostnames that he has visited, in addition to plaintext DNS