Putting the burden on ISPs is never going to happen. They are in the business of moving bits. While some, unfortunately, do things like traffic shaping, deep packet inspection, and all other sorts of middleboxes -- that is all for economic purposes. There is not nor will ever be an economic incentive for an ISP to filter traffic traversing their network unless it is directly impacting their operations. and when that happens, they take the most direct and effective route: bit bucket it and notify the offender to clean up their house :)
More secure devices is something we need no matter what. If compliance tests are required, I suspect that companies will emerge to provide management and upgrade services to devices. Manufacturers won't have to care of all aspects of security and will work with them. This will lower costs because economies of scale will happen inside the service company. This is going to require some standardization on the software platforms (but many are using Linux anyway) and the update methods. But those companies will become targets or accomplices. Beware.
Second pronge. ISPs should firewall customers from within. I have a concern that this is going to be another step towards the Big Brother. I'm not an expert of networking so I can't make suggestions here but if that webcam from a long time disappeared manufacturer starts doing DDoSes, the ISP cuts it off the Internet. This is fine with me. Beware of false positives.
Even if the customer figures out that which device that's to blame, the manufacturer may not have patches, or even be in business any more. So we end up in a situation where you need to replace devices, which ordinary people expect to have 10+ years lifetime.
I don't think you're wrong though, the ISP should shutdown harmful devices, but the manufacturer also need to be held responsible. It's just extremely complicated to address the manufacturer, because many are just reselling white label solutions, or companies created for that one product.
Honestly many of the IoT devices shouldn't exists to begin with, or be allowed to communicate with the internet.
The customer is the person buying insecure stuff and hooks it up to the internet.
If that makes it hard for new manufacturers to enter the market, they could always form an industry association and, through some combination of source code escrow and insurance, reassure customers their products will be maintained even if the supplier goes out of business. Travel agents, window manufacturers and cavity wall insulators all have such schemes.