If you don’t think ISPs can monitor your endpoint connections, you’re a fool. All they have to do is figure out where you are connecting, and even if it’s a VPN, it’s known. The IANA registers IP address ranges. All they have to do is identify that someone on a Brazil telco or ISP is connecting to one of the identified VPN-owned IP addresses, and they can fine them. It’s not difficult.
VPNs aren’t designed to anonymize you to your carrier. It only masks where you’re going on the other end.
Right. And they can force the ISPs to run government sniffers collecting packets going to clients from those IP ranges.