Indeed the ISP can only see where you go when using TLS, and that data can be aggregated to who you are along with everywhere else you go. It’s sensitive enough that in the US lawmakers decided on whether ISPs need consent to collect that info. Obama signed into force a requirement of ISPs to get consent. Then Trump reversed that. Biden did not reverse it back AFAIK.
W.r.t VPNs, you merely shift the surveillance point; you do not avoid the surveillance. The VPN provider can grab all that info just as well.
It’s worse than being reversible. The problem is that it’s unprovable. A switch from “zero logging” to “log everything” is wholly undetectible to users. You have to rely on blind faith that a profit-driven entity will act in your interest and resist their opportunity to profit from data collection. All you have is trust. Tor avoids that whole dicey mess and reliance on trust.