That's certainly true, although uncommon in my own experience because
providers make operational choices to avoid it. As much as possible, the
ability to enable or disable a service is kept at the same (or higher)
granularity than the MX names.
Yes, that would have been nice.
Unfortunately, where we had this (at a previous job) we had some customers on
the generic "customer of this ISP" domain that were paying for AV, and some
that weren't.
Simply giving them all the service wasn't possible, as the AV engine was
licensed on a per-user basis.
We also had to operate on the basis that AV and anti-spam services could only
be provided by explicit consent, since doing otherwise could fall foul of our
equivalent of "common carrier".
Ray