ISP can do anything with you DNS traffic. That's why Cloudflare DNS support DNS-over-TLS.

Yup, of course they can.

yes of course.. common in totalitarian countries