I agree with you g0slp, it should not be left up to the ISP.
I know some ISP's are promoting the security side of their product, but they cannot cover every eventuality. This is why I think it is important for the individual to protect their own system/s.
I recently visited an IT centre which has 15 computers for their local communty to use freely (an average of 250+ users per week). The only protection they have is an anti virus program that WAS only updated once per week on a Monday morning.