That seems pretty reasonable. Every provider has to deal with customers who sign up purely to use them for relaying spam, and blocking recently-compromised IPs

That seems pretty reasonable. Every provider has to deal with customers who sign up purely to use them for relaying spam, and blocking recently-compromised IPs is a perfectly normal mitigation step. Most providers in Gandi's class will do the same or have similar protections.