VPNs are not protection from anything....think about how you send data to the VPN.

As mentioned by the other user, the ISP is the messenger....so it can see what you send...they can also intercept the keys for a SSL transfer....since you need to exchange the data, and could spoof it if they have a copy of a root certificate....which pretty sure the government can get access to from all major ones....so then you have a bunch of government regions who oversee the ISPs.....and they can put in a tap ... Like the old days of wiretapping...they just put in the central datacenter and if that doesnt work....they go after the hardware switches......

Everything ultimately relies on the trust being established with the VPN before it can offer any security. That connection point is the dangerous time...that point is where it can occur....also it depends on the VPN also being secured after that.

Since the ISP controls the process, the only way would be to have a ZKP or OTP which would then require that you need to have a another means of getting that info transfered to you to avoid the ISP again.

Its hard....trusting a VPN is not the way.... especially when a lot billionaire ex military intelligence run them......