Blocking telnet to the routers. It should be blocked anyway as one of the most basic security configurations (hence the phrase, "cleaning up their act").
Telnet used to be the standard method to get shell access on remote computers. The only problem was that there was zero security in the protocol. Then ssh was created to do the same thing, but using secure channels.
SSH is such a common and standardised tool now that there should be no reason to ever need telnet. The fact that the routers are even designed to respond to telnet requests is surprising (and troubling).
If a device uses telnet, an ISP can protect the device by simply blocking traffic to it on the standard telnet port: 23.
I doubt ISPs would do it (too resource intensive), but one could also inspect traffic to the routers to look for the default password strings and block those packets. It's more of a technique for local networks than for ISPs, but it's another route for protection.
What makes this problem so big for these routers is that both the credentials and the telnet service are hardcoded into the firmware. You can't change it and can't turn it off. The only way to protect yourself is to block traffic to the device on the port it is configured to listen to (telnet port 23).