You are correct that not every single ISP sells this data, but for reference, back when Team Cymru's 'Pure Signal Recon' product was advertised under the name '

You are correct that not every single ISP sells this data, but for reference, back when Team Cymru's 'Pure Signal Recon' product was advertised under the name 'Augury', Team Cymru claimed that data sources included "90% of global ISPs". They currently claim to be ingesting and processing neflow metadata from over 200 billion (with a b) connections per DAY. So in theory, yes, route through enough ISP's, and you may eventually hit one along the way who isn't selling that data. That said, to my knowledge, no ISPs are required to disclose whether or not they sell metadata, and as profit-oriented corporations, have no incentive to be honest about that if asked. So it's something of a gamble to assume you can definitely find a path through n ISPs where at least one of them does not sell netflow metadata.