One of the reasons for the "HTTPS everywhere" thing that people have been on about is exactly because ISPs were injecting ads or javascript into web responses (

One of the reasons for the "HTTPS everywhere" thing that people have been on about is exactly because ISPs were injecting ads or javascript into web responses (https://www.infoworld.com/article/2925839/net-neutrality/code-injection-new-low-isps.html https://www.infoworld.com/article/2925839/net-neutrality/cod...). So, yeah, they've already been caught doing exactly this.