Whether it is or is not certainly depends on the laws in the jurisdiction in question, but personally I'd say it should be.

Russian malware authors agree with you.

Website host is not a utility. ISP is a utility. Having an ISP, much like having mail service, should always be possible for everyone.

I think website hosts should be able to drop people for most reasons, but that's not what's happening here

This is literally what's happening here. No one is cutting off the admin's personal Internet connection to get on the Internet. They're taking his website down because it's full of abuse.

They're cutting off the company's internet connection, which isn't significantly better than a personal connection. The entity doing this is not the web host, it's the ISP. I would be fine with a web host refusing service, but that is not what is happening.