Does the ISP care why the “bad” bits are flowing through connection? Operators large (Google) and small (me) use reputation metrics to filter traffic. When I get spam, I don’t try to figure out if Tor is involved. I block the IP. If it recurs on an adjacent IP, I dial up the netmask until it stops.