That's true -- I fixed virus and spyware-ridden computers in rural NW Missouri on the side at a tremendous price value. The people bringing them in would give me a puzzled look if I asked them if they had a firewall or antivirus program.
I contacted the ISP -- the ONLY one -- and let them know that they should be educating people when they send their technicians out to first hook people up.
Of course, that would probably cut into their service calls. Now that I think about it, they probably didn't care for me too much.
I think ISPs are afraid to confront or fix infected user computers. They could end up sued either way. If they try to fix a users computer and it does not work and there is damage is one way. Or if they tell a user they will cut off service unless they fix the hack that lets their computer be used by some hacker they could get a lawsuit that way.