You're mainly right about the solution - really only the ISPs can do much, and they tend not to.

CF actually wrote a pretty nice article about challenges in doing so - https://blog.cloudflare.com/the-root-cause-of-large-ddos-ip-...