We're both sitting on sofas, so I'm not sure what moral superiority you are claiming.
What should riders do? Ensure that it is reported each and every time that it happens, insist on race organisers employing a reasonable number of stewards, encourage decent supporters to make it clear to these idiots that they are not appreciated. They should also remember that they are paid to promote companies and products, and that they are looked up to.
I wonder if you have ever been involved in organizing a cycling event (road race or better: CX)? You would soon realize that the number of stewards desired is always lower than the number of stewards you are either able to pay, or simply, there aren't enough stewards (call them volunteers because that's what they are) the day before the race! Stewards in cycling are often at quite a respectable age, and their main goal is to make sure fans don't cross the course when riders are approaching, and they have to prevent fans from getting on the course as well. But stewards are not police, and contrary to e.g. a football stadium, you can't just silence hooligans in CX as they will just move to another spot on the parcours. Hooligans also flock together and it's hard and sometimes dangerous to intervene (as a steward or a decent supporter).
Riders have given up reporting incidents because they know the race organisers do their very best, and the whole sport lives on volunteers and goodwill. You need a lot of goodwill and positive energy to make a race happen, and it's very easy to not organise a race any more as organising is an uphill battle from the year before getting all permits, medical support, money from sponsors and people involved, let alone a decent field of riders.
I have more sympathy for van der Poel if there was beer and urine being thrown at him, but "endure the abuse"? Have you ever been at a football match?
That's the whole issue: CX is no football, and it has very few 'real' problems with 'fans', except during 2 weeks of winter stop in football (X-mas until beginning of January). As a result, many football fans who are bored for 2 weekends opt to go to a CX race to drink beer and they enjoy the freedom of attending a CX race where they can go where they want (in football, they are often escorted by police towards the fan bus, and have very little room to move, going to and from the stadium, and once in the stadium, they have fixed seats / places). They're also not used how close they can get to the athletes and it shows. For riders, going 30-35K/hr cutting off a curve where some football hooligans are throwing beer, is not only stressing but also a higher risk of crashing. Since the double barriers this has improved a lot, but still it isn't comfortable.
Can you name any profession, or any other sport, where one could respond in that manner to people giving you grief and expect to carry on without sanction?
Well, MvdP got fined as you already know. The fine is low, and I would reckon that, if the UCI / police / organisation could control the event better, the fine could also be higher, because there wouldn't be any excuses. But now there are excuses: a CX is a goodwill event, that only works if people behave, and organisers hope / wish people control eachother (and who wants a cx event policed like in football?). This has benefits for all parties involved: fans get close to the riders, riders feel comfortable, organisers don't need to overly invest in security... But it's a house of cards that can quickly tumble down with hooligans: riders can get unpleasant interactions, can get frustrated and subsequently fined, the year after those riders don't show up, the organiser will have fewer fans showing up and after some years a race can deteriorate and go down the drain. If the UCI wants to fine MvdP more, they have to make sure those hooligans are removed. The fact they only fined him 250 swiss francs indicates they can't / don't want to go that way.