ymmv, but most ISPs do actually push updates to their hardware. i'm not surprised to hear that some don't, however.

of course, you're right that the best option is to bring your own hardware. not only is it safer, but, in the long run, you save a ton of money.