Yes, I can see that it would be difficult for a major ISP to manage SPF - they are likely to be sending emails from any of many IPs. Mind you, nothing stops them configuring the SPF record dynamically.
It's time somebody did something real about spam. Spam filters based on keywords and text analysis do not work anymore. I get about 20,000 spams a day at work. Some 98% are dropped through the sendmail virtual user table so that's easy but that still leaves far too many. And in a business context one cannot protect addresses like sales@ ... using the virtual user table.