Actually they could set up an automated scripted firewall to allow connections only from the ip's that registered an account
, and maybe a registration option that would supply one or 2 more ips at most. The computing power of such a firewall should though reside in hardware processing since a software one might also fail due to heavy cpu usage. ISP acl's are moving the whole problem in the ISP's yard and don't need investments tho they're harder to update.