I'm convinced that (American) ISPs do passively log unencrypted DNS requests, so replacing their DNS with things like quad9 and not using dot/doh is mostly pointless, but the question was: will the isp hijack the response? I've never heard of one doing that, you?