Most likely they proxy traffic, act as a CA, and mandate devices used on ISPs have them as a trusted root authority.