I mention two separate issues.

ISPs are absolutely on the hook for forcing crap hardware onto (non technical) users.

Users are to blame for installing crapware.

Can you tell them apart now?

ISPs should be held liable for the crap they sell – they’d start taking security seriously.

As for users, depends on the motives, but educating them to the risks (and not in a you wouldn’t download a car way).

Residential routers have crappy security 'cos no-one bothers to punish ISPs for crap security practices.

Also some free VPNs come at a malware cost.