a. That's not the government's job.
b. Once a new power is in place, it will be used, and not just for whatever the original intent was. We separate policy from mechanism in software for a reason. It works in law too.
As for A, it became the government's job when provider apathy with regard to infected clients and hosts with botnet controllers etc permitted a situation to arise where the means of a (supposed) attack for a foreign power is actually based within the US. At that point it stopped being a private security issue and became a national security issue.
I don't like it, but the problem it addresses does exist.
How would you separate policy from mechanism in this case?
As for shutting down hosts involved in a bot net, a court order can do that in an emergency already. Sure, it adds a delay, but it also adds oversight and separates policy from mechanism. The executive branch controls the policy, while the courts control the mechanism.
Unintended consequences aside, this is less about a kill switch or government censorship and more about forcing a industry that has not taken security seriously to get their act together.
Many providers don't actively police their customers for botnet activity or respond to security incidents that don't affect their network infrastructure or back office systems.
This appears to establish a regulatory framework where network security officially becomes more than a law enforcement issue and lets DHS order operators to secure their networks and help out if they are unable to do so.