I mention two separate issues.

ISPs are absolutely on the hook for forcing crap hardware onto (non technical) users.

Users are to blame for installing crapware.

Can you tell them apart now?

ISPs should be held liable from the crap they sell – they’d start taking security seriously.

As for users, depends on the motives, but educating them to the risks (and not in a you wouldn’t download a car way).