ISPs are to me like infrastructure. They are like roads or power lines. If you ask the ISPs to block malicious activity it's like asking the electrical poweregrid to be responsible for stopping their electricity being used for illegal activity. Asking the ISPs to block malicious activity is like asking the road builders to be responsible for bankrobbers and murdere driving on the roads. It's simply just ridiculous to put the responsibility like that.
What i find most stupid about all of this is that Air Canada could just have admitted a mistake, payed The refund of ~450 USD which is basically nothing to them. It would have waisted no one's time and made good customer service and positive feedback. Then quietly fix the AI in the background and move on. Instead they now spend waaayy more money on legale fees, expensive lawyers, employees sallery, have a disabled AI, customer backlash and bad press all costing them many hundreds of thousands of dollars. So stupid.