What am I missing?

On my (broadband) connection, all the machines on the LAN are configured to point to the router as the DNS source. After that the broadband provider sorts out the real DNS server.

1. Sounds like I only have a problem if the broadband provider has DNS malware.

2, Also sounds like a lot of people have their machines connected directly to their cable modem with no router/firewall to protect them. How hard can this be?