Thank you this answers my question!

TLDR basically the size and frequency of data being sent to and from a website acts like a digital fingerprint even if ISPs can’t see what’s in those data packets. Looks like there’s an easy fix by having VPNs add random background noise data.