They could but it's whack-a-mole and most ISPs just route abuse reports straight to /dev/null.

IMHO, ISPs caught in that act should get yanked off the internet.