Why is this so surprising? You pay for your internet from this service provider and this is the trust you're putting in this private company. All your communication that goes down this channel is subject to their rules, and unless you encyrpt it they can do what they like.

I think these kind of crappy implementations just surface a bigger problem underneath. If you don't choose your own DNS servers, if you don't have proper DNS security, https by default everywhere etc. etc. you don't have a secure connection.