This also explains why VPN is a possible workaround to this issue.
Your VPN will encapsulate any packets that your phone will send out inside a new packet (its contents encrypted), and this new packet is the one actually being sent out to the internet. What TTL does this new packet have? You guessed it, 64. From the ISP's perspective, this packet is no different than any other packets sent directly from your phone.
BUT, not all phones will pass tethered packets to the VPN client -- they directly send those out to the internet. Mine does this! In this case, TTL-based tracking will still work. And some phones seem to have other methods to inform the ISP that the data is tethered, in which case the VPN workaround may possibly fail.