> Now I figured it's an ISP.
It's not an ISP, it's an email provider.
> Modern legal systems usually limit criminal liability to individuals [1]. Companies engaging in acts of collective punishment (That goes for you too Cloudflare) should at least try to raise their ethical standards to those expected by International Law.
There is no "criminal liability", and blocking malfeasants on the internet has always been a heuristic fight. If a service originates an extremely high rate of fraud versus legitimate uses, it's a good heuristic for fraud. It's a shame for legitimate users, but it's also how it's always worked.
And more generally minor (or self-hosted) MTA have always had that issue, it's not news that they get delivered less reliably than big "trusted" mail hosts, and that they can get blacklisted real fast.