HTTPS spills what services you are communicating with, but not the content…

…except approximate content sizes and timing patterns.

The GP claimed they can inject ads though

They sell metadata. DNS queries, locations, apps using data, device info. Usually anonymized, but both unscrupulous and "better" providers do have access to your account and payment info.

GP claimed they can inject ads. How does that work with HTTPS?

They can't inject to the http response, but ad servers that work with the VPN or their data brokers can better identify the requester and serve better targeted ads.

I reckon that if HTTPS was sufficient to hide your online activity, then you wouldn't need a VPN to hide it in the first place.

If HTTPS were for privacy it would be called HTTPP. Security features tend to make things less Private, like how opening apps on a Mac makes it phone home for OCSP check.