Couldn't cloudflare show a page to the next handful of http requests from an IP informing the user that "something on your network is participating in DDoS attacks".

All the big providers could do this, just inject a little turnstile like page in front of the next cloudflare site you visit.

I would love to know if there's a compromised device on my network, and I don't have any real monitoring set up to detect it.

It's not a full solution, but at least informing users there is a problem is a good start.