That is a very easy case to make in the US. ISPs have incredibility broad safe harbor laws (even more so when just providing transit instead of actually hosting like this case). They have very broad protection from the consequences of their users' actions.

They are not just providing transit. They are the front-end webserver receiving the request and sending the response. Transit is someone like AT&T or Sprint.

>They are the front-end webserver receiving the request and sending the response.

When providing ddos protection they are mostly filtering out the attacks then forwarding traffic to the customers back end server. That describes 'transit' pretty well.