Even with secure DNS, the SNI part is passed as plain text for the ISP to intercept and block.