ISP can do anything with you DNS traffic. That's why Cloudflare DNS support DNS-over-TLS.