router99 Of all possible files that can be downloaded across the entirety of the internet, while using a VPN, an ISP isn't going to know fuck all what file it is specifically.
Actually, yes. Especially if you have a pattern of downloading a very specific kind of files. They can just have built up a database with all publicly known "files of interest" and their file sizes ahead of time, and if they see a pattern of a user only downloading files those file sizes matches entries in that database, it is extremely likely, over 99% likely, they are in fact downloading those files. This is enough to even get a search warrant. These statistical attacks and similar ones have been used in practice to detect and arrest people downloading and sharing CSAM for example. Even a small amount of random padding, such as 1% padding, can conceal the file identities though.
router99 My impression of your post is that one might as well not use a VPN at all.
No, not at all. I am just saying that the nodes closest to you should be the most trusted ones, because they are in the position to perform the most advanced correlation attacks against you. Especially the active ones are scary. I rather argue for the opposite of what you say, that a single VPN is not enough, you should have more hops.
router99 To say "everyone have panicked" is, again, hyperbole.
Well, it came as a surprise at least to the Tor project just how detailed per time unit the logging ISPs do is. It is a few years ago, but they rushed to implement padding specifically to prevent such logs from being useful.