small hosting operators usually have few actual paid IP transit upstreams (2 or 3 max), which can credibly disconnect them based on criminal activity.

they also usually have a small number of actual manually-configured peers and if they're a member of an IX, they use the routeservers instead. Very easy for an IX to disconnect a criminal entity.

disconnecting a HUGE network that has a large portion of abusive traffic is much harder, like trying to bgp blackhole some major ISPs in China.