We see here multiple problems:


a) DNS Seeder (only affects the handful of operators who runs a dns seed)
This solution should not bother normal bitcoind nodes.

b) Nodes which cannot connect to sipas dns seeder because some system has detected his IP as malware severing IP because it does netscanning (that is what a seeder needs to do). Maybe IPSs share informations about malware serving IPs.
This is not a problem for a bitcoind node, because it can fetch IPs over different seeds or over the internal static list. As soon as one feasible IP/connection could established, more IPs come in over getaddr

c) ISP detect portscanning behavior on a bitcoind node:
Nodes can send you unroutable IPs addresses though getaddr. Example: 242.0.0.1. If your bitcoind then try to connect to this ip, no route can be found and your ISP might detect this as a port scan.
You could solve this theoretical problem by using tor or limit max connections.