Oh well, who doesn't. This thing with DNS is like the dark secret of the VPN industry because if you think about it all those VPN providers run their own DNS servers and tunnel the DNS traffic via their tunnel and when they don't you know what happens - if the ISP can still redirect your DNS queries it will still get your traffic.
Either way, this is more of a people problem than a tech problem. You did right by telling her not to use so much social media and share less data, but it's all about a mindset. It's about the person that sees a cookie popup and goes in all options and disables everything. That never clicks on an offer for a "free service" and looks for the almost indivisible "skip setup" option.
Besides the convenience aspects I believe there's something fundamentally wrong with people's education when it comes to cybersecurity and privacy. People should think of applications, services and websites like strangers on a street: if a random person ask you where you are going will you tell him? No you won't, then why would you share your location with any app by default? If someone on the street asks your for your address will you give it up? No! Then why would you provide your e-mail address to any website?