Okay, maybe I got the question wrong. If you care about content blocking, then you are right (though I'd prefer self-hosted resolvers like pi-hole or AdGuard Home over third party resolvers).
As far as I read (I'm no expert!) they could check the SNI of the TLS handshake if they want.
But using the DNS of the ISP is handing them the data right in a way they can analyze/use them very easily afaik?
They route your traffic, hence they can see all IP addresses you communicate with. With a reverse lookup you can then usually find out the address too.