In most cases the device is getting it's IP information on boot by negotiation or request from the ISP. All the ISP needs is a database of blacklisted equipment and some middleware box to receive connections from insecure home devices when it detects them.

It's not about catching related traffic when it occurs, more managing the immediate implications from insecure devices on the network. The ISP can see the device, it doesn't need to inspect the traffic.