Your main carrier sees that your sim card connected in foreign country using another operator. And they have all information about details of this connection (enough to locate it, and some︀ operator APIs for IoT SIMs even have easy way of locating connections of your own︁ sim cards as a feature provided to the users), they see contents of sent and︂ received SMSs (e.g. bank verification codes could be important for shady operator), connections you made︃ (to whom and how long they took), how much internet data you uploaded and downloaded︄ etc. This is on the lower layer than internet connection (as this is on cellular︅ connection layer), so VPN will not help with it.
Often your internet connections go through︆ your main carrier proxy, even when connecting from abroad with different operator (you can verify︇ this by using some IP-location tool when you will be abroad - most likely it︈ will display IP from your main country and location in your main country, as traffic︉ will be exiting through your main operator). So, while your connections through the internet will︊ be encrypted by you, this also provides some interesting metadata and additional attack surface.
This is all in normal setting with normal operator. In situation when you are using shady︋ operator and they will try to hack your device and succeed, of course it's much︌ worse.
