[subie]

The attacker is still spending resources giving out instructions to the bot army.

Unless they are using a setup like @tomschlick mentioned or some P2P thing.

[pixl97]

Sending out a message to 1 million compromised devices takes almost nothing. Also, if you've compromised 1 million devices, chances are you also compromised a linux server on a fast host for command and control.