Users don't want to manage it, and ISPs don't want the tickets.

Heuristic based systems would probably work in most homes, where devices are limited by their historical bandwidth. New devices are unthrottled, existing devices are limited by their historical bandwidth usage with some bursting.

I think most ISPs have apps to control your router now, you could have it trigger a push notification like "Device X is using more bandwidth than normal, and we're throttling it. Press SCARY BUTTON to unthrottle."

You would want the advertised speed to be approved by the user at the time of setup.

If it was automatically accepted, the malware would just change the advertisement.