"what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with

"what better way of providing automated defences at scale than by the major private providers effectively blocking their customers from coming into contact with known malware and bad addresses?" By designing a system for distributing filter rulesets to the endpoints. Works fairly well for in-browser malware blocking and adblocking. And if users can retrieve rulesets from configurable sources, it allows them to tune how aggressive their filtering is, and avoids turning every rule into a potential national censorship row. By comparison, making ISPs do DNS filtering is of middling effectiveness and screams of "just give me all the control and trust me to sort it all out."