AFAIK most people's contract with their ISP includes fine print that forbids a lot of the nasty things these IoT and "smart" devices do.
Doesn't matter from the point of view of a lawsuit from an outside attacked party.
What do they do that you think is prohibited by a residential ISP contract?
Doesn't matter from the point of view of a lawsuit from an outside attacked party.