Seems like a modern ISP would already be equipped with some basic level of packet inspection to identify outgoing TCP connections even if just for doing traffic shaping or carrier-grade NAT, and maintaining a reverse lookup does not sound prohibitively expensive.
Normally DNS traffic is in clear and can easily be sniffed by the ISP (just sniff port 53), making it possible to create user profiles. And not only could the traffic be sniffed but it could also be redirect to the ISP's DNS server in order to give a different answer. This is a typical way to block domains at the ISP level.
DoH uses HTTPS for transport and this way gets the protection of HTTPS against sniffing and traffic modification. Sure the DoH server itself now has all the information and can also provide a different answer, i.e. the ability for profiling and domain blocking did not vanish but it moved to another party. Ideally this party would be more trusted than the ISP though.
... maintaining a reverse lookup does not sound prohibitively expensive.
A reverse lookup is of not much use today since often many domains are hosted by the same server (and thus IP) or since they are served by a CDN where even more domains have the same IP address. So there is often only a weak association between the IP address and the domain. A deeper traffic analysis might reveal the hostname from the
Host header in case of plain HTTP and from the TLS handshake (
server_name extension of ClientHello) in case of HTTPS. But plain HTTP gets less and less used and for HTTPS they are working on hiding the name in the TLS handshake too with Encrypted SNI.
In summary DoH does not solve all privacy problems caused by the ISP. But it is another step to make it harder and more expensive to create user profiles in the hope that the value of the remaining profiling for the ISP is less than the investments needed for the profiling.