Deciding who they do and don't want to do business with is fine. It's not their job to protect vulnerable domains. Actively sabotaging someone so they can't take their business elsewhere is not OK -- especially when their offense boils down to, "we didn't tell you that someone else was attacking us." That's not doing anyone any favors except attackers.

Bear in mind, the context here is not domains doing something awful or spamming people or mounting your own attacks. It's "somebody's attacking you, and we think that you suspected they would".