There are many parts to the answer of your question, but one part yet to be implemented in a meaningful manor is BCP38 [1]. The RFC's around BCP38 keep changing and that may be part of the issue. It is still too easy to spoof the source across ISP boundaries. Then of course there is also the issue of getting all the ISP's to work together to detect and mitigate these attacks and that involves cost that the tier 1 providers barely spend towards. There are so many more pieces to this problem and I am barely touching on it.

[1] - https://www.rfc-editor.org/info/rfc8704