I'm pretty sure they can't refuse. At least in the US. Correct me if I'm wrong.

Sounds like Comcast lol they suck. It sounds like you are using the router provided by your isp. Try getting your own equipment (router/modem).

Was wondering this myself. Is there a way for users who where exposed to know about it?

(Edit) Eg if the exploit was through a post get notified if they saw the post?