[gnfargbl]

True, but the bad actor's code doesn't typically run directly on the infected device. Typically the infected router or camera is just acting as a proxy.

[mike_hearn]

There are ways to detect that and it will still require a lot of CPU and ram behind the proxies.