I think the original analogy is very poor, personally. It implies that the responsibility shouldn't lay with the ISPs by comparing them with manufacturers of vehicles. ISPs are much more like the people who manage and regulate the roads and toll booths. Unlike card manufacturers with bad drivers, ISPs actually in an ideal position to effectively address the problems of infected computers. In addition, they provide the resources (which belong to the ISPs) that an infected computer requires in order to be a threat to the Internet at large (and thus other computers). It is the ISPs networks that they sell. And most ISPs actually have in their contracts with their customers (at least in the US) that their networks may not be used for crime, abuse, etc. So, the ISPs likely have legal standing already to enforce the issue.
Although, turning those users "off" without warning and giving alternatives is a bit extreme. It would be nicer (as I've seen with some ISPs in the US) if the user were notified that suspicious malware-related communication is coming from their Internet connection. And if not resolved after a notification or two, disable access until the problem is resolved. Again... it's the ISPs' networks that are also responsible for the problem... not just some end user's computer.