If IoT botnets become more prevalent (and it doesn't seem like IoT makers have incentives to make their devices more secure), I wonder if ISPs will just start monitoring the traffic patterns of their customers for possible DDoS activity and possibly throttle or cut off their internet connection to stop the attack at its source. Probably would even be compatible with most net neutrality regulations around the world, since it's a security issue.

You could probably hide DoS traffic from a single device by making it very low volume, but if the ISPs coordinate, they still know that the device recently sent packets to a victim of a DDoS attack, making it suspicious.