Because your ISP will hijack the queries it makes.
While that could very well be the case, I find it funny people tend to assume their ISP does this, and also assume that trusting large corporates (often outside the jurisdiction they are in and subject to foreign law enforcement requests) with their data is automatically preferable to their ISP.
In the absence of widely-deployed ECH the ISP can potentially still see all hostnames visited from SNI field.
Some fears you commonly hear about from US users, like ISPs selling user browsing data, is illegal in other territories like the EU. So this calculation is different in various contexts. Where ISPs are not able to monetize it you would wonder what the business case for the (very expensive) snooping of queries is.
Can you name one that does?
With traditional DNS, your ISP can monitor everything you query passively. They also see every host name you connect to using TLS with SNI. Since that’s passive, you don’t know who they share that with except to the extent that you trust your government’s privacy law’s & enforcement.
They can also spoof DNS replies if they want to send you to a different server. This used to be common for Wi-Fi login systems when most of the web ran on HTTPS but TLS breaks it now. This is an active attack which is usually pretty blatant so you won’t see it commonly on residential ISPs.
DNS over TLS/HTTPS breaks all of the passive DNS monitoring & active spoofing. It does not help with TLS SNI monitoring but there’s an Encrypted Client Hello extension being tested now for that.
https://arstechnica.com/tech-policy/2009/08/comcasts-dns-red...
Maybe I'm just bitter because I've found DoH (and even DoT) to be slow and occasionally unreliable. Even using Cloudflare, which is my fastest DNS, I see my local caches hitting strange resolve errors or in the minimum, durations 4-10x slower than good old UDP.
Shared hosting breaks that. If I connect to an IP used by AWS, Akamai, Fastly, etc. there are literally millions of things I could be using but the SNI header will tell them which one.
As a practical example, if a school administrator in Texas sees a connection to 104.16.12.208 they only know that someone is connecting to one of the millions of sites behind Cloudflare. SNI tells them it’s Planned Parenthood and they can call the police to report an offense against the church.