ResiP apps are highly problematic. While the premise of having easy access to a nearly infinite number of residential IPs for super cheap is appealing for all sorts of reasons and may even have some legitimate uses such as for anti-circumvention campaigns that would route traffic from activists in democracy challenged environments through residential IP exit points thus mitigating the abuse penalty incurred by commercial or Tor gateways, abuse of ResiP systems is rife, likely dominant.
Servers used to see script kiddies attack via abuse tolerant VPNs or colo/virtual host tenant farms and so were easily managed by detecting a pattern of malicious attacks coming from a finite number of IPs or C-classes or domains and against this reactive intrusion detection tools and IPBLs have been useful. Someone attempting credential stuffing might get a few guesses down the most common password/account list combos before being locked out and then move on to the next target in their list. Now logs are filled with the same sort of attacks: password:toor@server.com, pasSSword:toor@... etc but each sequential try comes from a different IP, often a different country. Dynamic block lists exploded from dozens (my Fail2Ban list ran 50-200 or so IPs) to thousands of IPs (today 8,065 IPs and 514 C-classes, most listed for one obviously malicious connection attempt).
Tor exit nodes do carry some of the same issues and running one will result in reputational consequences for your IP, just as running a ResIP app will for every connection you pair with.
A difference in practical implementations that matters is that setting up a Tor exit node isn't trivial and the consequences are well documented; the people capable of doing so generally also competent to comprehend those consequences. ResiP apps require no particular competence and are often marketed in deceptive ways. Further, the "exit point" moves with the user-device. Everywhere they go, they spew malicious traffic and criminal activities over whatever end point they connect with: home, friends, LTE, coffee shops. Every hotspot the device pairs with becomes a victim of the crimes enabled by the app.
ISPs need to look for indicators of ResiP exit nodes (if you block the command and control domains, you'll see traffic move to direct DNS across all commercial DNS providers, block those and traffic moves to DoT and then DoH, at which point the ISP should blacklist the client until they clean up their proxyware infection.
