It's not just about sensitive data, your ISP can easily inject some crap into the website if it's not on HTTPS for example.
(it happened in the past many times)
Here's an example; https://security.stackexchange.com/questions/157828/my-isp-b...
(it happened in the past many times)
Here's an example; https://security.stackexchange.com/questions/157828/my-isp-b...