What are the security risks that someone using HTTPS (everywhere) + DoH is vulnerable to, comparing to someone using a "trusted" VPN?
A VPN provides an encrypted tunnel from the VPN client to the VPN exit. All that somebody in the path of the tunnel (like the ISP) can see is that there is some traffic between client and exit, including how much traffic and some timing. With HTTPS + DoH the application payloads and DNS lookups are encrypted too, but much more meta data are visible: the IP address of the servers visited, the domain names accessed since the majority of the TLS handshakes still use plain SNI (and no ESNI), the communication pattern to specific servers instead of only the aggregated traffic between VPN client and VPN exit etc. Based on these available information an active man in the middle can with a VPN only block the whole VPN, but with HTTPS + DoH do more targeted blocking for specific domains and IP addresses.
But with both VPN and HTTPS it is not possible to modify the traffic, only gain more (HTTPS+DpH) or less (VPN) information and do more (HTTPS+DoH) or less (VPN) targeted disruption of the traffic.