Correct, DNSSEC is like a signature, you can be reasonably sure that DNS wasn’t poisoned. If you’re looking for encrypted DNS, use DoH (DNS over HTTPS) or DoT (DNS over TLS).
While I have great confidence in my ISP, I use Quad9 as they also provide the above plus don’t do ECS (optional) and block malicious domains.