As someone who works for the government and whose team is doing nothing but fighting against bad actors, I don't think that's true. We're not doing nothing, that very unfair assessment.

It's like saying "we shouldn't have to lock our doors, but the governments are doing nothing to stop the robberies". And the internet is much more wild than the real world, IMO. The biggest obstacles to the safe internet I see are:

* Globality. Aspiring Russian cybercriminal can hack from their own basement with no OPSEC and VPN without any fear of repercussions as long as they don't bother anyone in Russia (and neighboring countries). Before COVID we used to have literal "wanted posters" (as a joke) in our office with names, addresses and photos of known cybercriminals that we could nothing to arrest, because they resided in another (usually Russian-speaking) country. Even in Europe it's not trivial, because Europol has relatively high requirements to start an international investigation and extradition, and "regular" cybercrime doesn't qualify - so one can send malware across the border as long as they want without any (real) fear.

* Velocity: there is no such thing like "bad actor ISP". I mean ok, there are so called bulletproof hostings, but in general the bad actors buy things like anyone else. The typical phishing campaign starts with criminal buying a domain (using fake data), cheap (or usually free/demo) hosting account, getting a letsencrypt certificate, uploading some fake login form HTML, now just send a few hundred thousand emails/SMS and you're done. Next day tweak some things and do the same, just with a different domain. The typical phishing campaign is live only for a few hours. There's no way a lawful country can make a proper legal decision in a few hours. And this is assuming no international cooperation - usually the server and domain are hosted by another country than the attacked country, so we're talking about contacting another country to make a legal decision in a few hours timeframe.

* Censorship fears: Ok, so a proper timely expropriation is not possible. What we have in practice is a list of more and less formal blacklists, like Google safe browsing, (extremely annoying and opaque) spam blacklists, and many lists of unsafe domains (my country provides one). In most cases the lists are DNS based, and they work great. In my country, our list is also applied by some ISPs automatically (so home users are protected as long as they don't change theit default DNS). It would work even better if every ISP applied it, and blocked malicious plaintext DNS requests on the wire, but I can already feel HN readers becoming tense as they read this (I don't like it too). We all hate censoring the internet, and want to preserve the right of normal people to be scammed by visiting a phishing website.

* Money: Having a dedicated abuse team cost money and brings no revenue. Just look at how google does it, and they are drowning in money. Imagine how responsive are smaller providers. In many cases you could as well try to contact /dev/null.

* Privacy: This rant is getting a bit long. I'll just mention that one of my colleagues (frustrated when a known criminal managed to turn off his computer and was let free later, since his disks were encrypted and there were no strong enough evidence to jail him) said "law abiding people have no reason to encrypt their disks". Of course I strongly disagree, but I share the frustration. With god-mode on the internet (the ability to read all the communication, get into any server and take down any domain) I could do so much more to help people in my country. I guess that's also what drives NSA and similar agencies to get more and more power. Unfortunately, we live in a democracy, so we have to make compromises, and I think the compromises we make (i.e. that my powers as someone fighting cybercrime are reasonably restricted) are good ones.

Personally, I think a big issue is that there are no legal repercussions for ISPs/hostings that repeatedly host malware/phishing. Even if they respond to abuse and take down something (maybe even block the account - the horror!), the same happens few days later and there's nothing that can be done. I think financial fines for gross negligence would really help to align the incentives here.