You are speaking of basically an IP-based version of the spamhaus blacklist. For general http or TCP protocol.

I, for one, would be fine with a general internet citizen losing access if they have a compromised device. I suspect this is how we will go -- your home security cam was used in an attack, now every single website you visit for XXXXXXXX days gives you a CAPTCHA.

I maintain the crucial element is informing people why they have that hassle. Add extra friction, but not inhibit what they can do, because they are unable and unwilling to secure their devices.

Yes, this affects the internet-uneducated disproportionately. Yes, I think it is the responsibility of anyone with a broadband connection to understand the responsibilities that come with it.

No, I do not expect grandma to learn this. I expect her to deal with a crippled internet because they are not able to fix their pollution.

Two issues: NAT and dynamic addresses.

NAT: blocking an iot address may be blocking grandma's whole network (or her whole apartment complex's network), and the ISP doesn't want that support call.

Dynamic addresses: depending on the ISP, the IP could change quite frequently (daily), so keeping the list up to date to avoid collateral damage to the unlucky recipient of the blacklisted IP is very difficult.

L3 already confessed to having build a list of >500K Mirai bot static IPs, they used it to .... do NOTHING, because they are in business of selling pipes, and ddos makes good business.

In germany, the Telekom (T-Online) used to block http or SMTP traffic when they recognized an infected connection which sent SPAM emails. Don't know if they still act like this.