I see a few services advertising the ability to protect against phishing and ransomware attacks. ISPs sell services which supposedly protect you and some routers like Check Point 700/900 series. Is this real? How does this work? If I download malware/ransomeware or am sent a phishing email - that's likely TLS encrypted. Can the ISP/router decrypt and scan such traffic? Or is what they're advertising only for non encrypted traffic or just doesn't work?
In general, phishing attacks comes on emails, and the majority of ISPs gives you email services for you in their platforms not on the home routers (in general). So the email services are hosted and process by your ISP, that is normally how ISPs protects you from that types of attacks.
For phishing attacks normally they have antispam/antiabuse systems that allows them to filter domains, ips, suspect emails and so on