While the hardware provided by ISPs has improved, I still believe the software remains a weak point. They don't seem to be doing much in terms of keeping the software stack up to date in general, which is counter-intuitive since a compromised customer router means that ISP will suffer from blacklisting and increased data usage from that customer.
Again, looking at the TM-AC1900 as an example. The original RT-AC68U still receives updates as of today (2022), but T-Mobile stopped providing software updates years ago. I don't have any insider info as to the details, but my personal guess is, they struck a deal with Asus to buy a large quantity of these devices at a discount, and to keep the costs low, they didn't want to pay Asus for long-term software support. They probably paid for something like 18 months of software development, and after that they basically dropped the product, despite the hardware platform still very able to get recent security and feature updates.
I guess this is what generally happens with others as well. ISP buys a certain amount of devices, and paid the manufacturer for limited software support, in addition to the original rebranded UI.
Years ago, I did receive offers myself from at least one ISP who wanted to hire me to provide a rebranded firmware for their service. Based on their offering, I don't think they expected that this rebranded firmware would require continued work to provide security updates after the initial development, so discussions never went far.