Wow, I didn't know VPN providers have broken SSL and can read all that traffic.
This was on the frontpage before. Are people just upvoting it for the clickbait headline without reading the points that are being made?
They could do per-flow logging of TCP flows (subscriber 89 made a TCP connection to 1.2.3.4:567 starting at 12:00:05, ending at 12:02:04, transferring 10kB up and 1MB down). In the worst case this would also include the TLS SNI, which is transmitted in plaintext.
Or it they could do logging based on the endpoint (subscriber 89 transmitted 1MB from IP 1.2.3.4 in the 15 minute interval 12:00-12:15).
DNS, SNI and mixed content are all insecure for the vast majority of users. You can learn a lot from HTTPS traffic.
If you think TLS is adequate to stop a VPN provider figuring out what you're doing, why isn't it good enough to stop the ISP/Government/evil coffee chain IT team?
Short of using a VPN provider that's a front operation of the government you're trying to avoid, VPNs do a good job in adding a layer of protection. The proposed solution in the article (rent a VPS) does not, as the IP is unique to you and tied to your identity, the hoster has no incentive to protect your identity.
And metadata can be just as useful for violating your privacy as content data.