actually you pay for it
yes the upgrade might be risky but the reward is you can sell a higher bandwidth package... thats how it works... people vote with their wallets
personally I would prefer if ISP's would charge the contract owner if they got notified of bad traffic just like they do with corporate contracts.
that would force people to actually put some effort into not have infected virus laden machines lingering on their home wifi and incentivize people
having a network that supports things like DNSSEC and IPv6 would be useful not only for scalability but for network admins helping the end user track down which machine was the problem & billing, much like mobile networks do now (most mobile networks are IPv6 )