> how is it any more secure than https?

Using a VPN doesn't expose the domain names you're viewing (via SNI) or the IP addresses you're connecting to to your ISP. It also (therefore) doesn't expose to the ISP the volume of traffic you're sending to a particular site, when you connect to it, or how long you stay there.

Whether your ISP is part of the threat model you're interested in mitigating is up to you personally, but this is how, depending on that model, a VPN can be more secure than HTTPS.