No. ISPs should not get into the business of default block rules. This gets into all sorts of problems. At what point does a block become unreasonable? What if a tenant needs multiple sites in sync -- they must run NTP between them (or PTP) in order to determine their drift from one another.
If you really want upstream blocking of traffic, the best thing to look towards is BGP Flowspec (RFC5575)
The same way all Upstream providers blocks a DDOS - by characterizing the DDOS flow, scrubbing, and dropping any packet which matches that pattern.
The idea here, is that during a DDOS, where you might get a bit more NTP drops than normal, none of the local users should be impacted if they had a quality local time source.
"What if a tenant needs multiple sites in sync"
That's why you have a quality time source. By definition, they are "correct" to within any tolerance that all but CERN physics experiments care about, and they don't use NTP anyways.
See: http://static.googleusercontent.com/media/research.google.co... for an example of using synchronized time globally, without reliance on running NTP between sites.
In particular, check out section 3, "TrueTime"
I guess what I'm trying to say is, you should already have this ACL'd on your own.
The NTP DDOS doesn't require that the web server (or, indeed, any server) at the target be listening to UDP/123 in order to cripple them. You just need to use up their circuit capacity.
What I was trying (and failing) to suggest, is that when the Upstream starts scrubbing out the NTP DDOS, there is a reasonable chance, that during the event the downstream customers will start to see more NTP drops than they normally would. And that one way that customers who care about NTP greatly could mitigate that possibility, would be by having multiple stratum 0 sources locally - I.E. A GPS Antenna and Atomic Clock. I then took it a step further, and suggested that this would be a great service for the CoLo to provide, because they are downstream of any packet scrubbing, and would therefore be able to provide a reliable time source during a DDOS attack involving rogue NTP traffic, which might end up with some NTP packets being dropped by the upstream ISP who was scrubbing the DDOS off the circuit.
For larger ones, having local strata0 timesources are an option. GPS gives you very precise, relativistic time for extremely low cost. (Bias: /me == Frmr Trimble employee.)
Level3 was the last one I know that would put in an upstream ACL.
Other than buying ports that are greater size than any potential DDOS, that is the only way you can defend against a flood of traffic.
Providers won't care if you asked for the traffic or not. You'll get billed. They won't put in an ACL. Not today. 5 years ago, maybe. Today, no chance. They'll want to sell you their own DDoS mitigation services (at hefty fees).
TWTC (and others) will sell you a "clean pipe" option which includes mitigation, and you only pay for what passes through mitigation. It's more expensive than regular transit, but it's an option if you want to keep things simple.
ACLs are not an option today.