"if ISPs stepped up and started emailing customers about suspicious traffic coming from their home networks indicating one or more devices may have been compromised" - I remember Comcast doing something like that back in 2008ish.