The reason we can't just block ranges is because CGNAT means that we wind up having to block entire providers instead of the individual with the compromised machine.
IPv6 would solve this and we get the end-to-end nature of the internet back. So everybody will start screaming for IPv6 when?