I think a solution that generalizes and has the possibility of actually working is for the result of compromised hardware to show up in the consumers' bill. We

I think a solution that generalizes and has the possibility of actually working is for the result of compromised hardware to show up in the consumers' bill. We expect to pay a low, fixed, monthly price for unlimited bandwidth, but what happens when someone else gets their hands on that bandwidth? It's nice to hold manufacturers accountable for their woes, like shipping routers with "admin":"" creds, but what about all the other reasons devices get pwned, like users downloading malware or falling for those fake download-button ads or using something like Hola VPN that turns them into an open relay? Some ISPs will give you a phone call or shut you down entirely if they probabilistically think your bandwidth is compromised, but that involves a lot of complexity. If ISPs weren't racing to the bottom with the meaning of the word "unlimited", they could be honest about bandwidth prices and service levels instead of using a complicated throttling system to maintain the facade that bandwidth really is unlimited. Also, there would be natural filtering pressure against, say, insecure IoT devices that end up impacting people's ISP bill.