Doesn't matter from the point of view of a lawsuit from an outside attacked party.

IANAL, but a harmed party outside of the 'binding arbitration' nonsense might be a way work around arbitration and drag the company into a court.

Exactly, the harmed party is not subject to binding arbitration. The harmed party isn't going to bring someone to court for their bad devices - nobody has enough assets to be worth suing (other than perhaps to compel them cooperate with the discovery process) . However the company that made those devices is worth suing.

Alibaba is an interesting question though - if the device is from China (or some such) it isn't clear what the courts can do...

What do they do that you think is prohibited by a residential ISP contract?

Running a proxy server and running a botnet, at least.