Distribution is the key here, which they can pinpoint to your IP. They can’t come after YOU specifically (usually) but they contact your ISP

Germany:
Which in turn hands out your contact data. And Waldorf + Frommer will send you a form for a Unterlassungserklärung, which you are kindly asked to sign. Plus they will kindly ask for a few hundred euros.

Who then sends you a strongly worded letter about stopping (usually). If this happens repeatedly they will often throttle your bandwidth or even cut you off. Again, usually. This is different everywhere.

Nope. Not the ISPs job here.