CPU's aren't that efficient. Unless it's an absolutely massive botnet I think we can just think of the operator as another miner. Further he is a miner who is bringing hashing power online that almost certainly wouldn't have been used to secure the network otherwise like your grandmas pentium and your uncles toaster. Asics make real decentralized miners unable to compete in a way that I don't think botnets do. Point is, I don't mind botnet miners. They are going to go somewhere. They are going to point their hashing power at something. I would rather it be us.
Also it isn't clear that there is anything that could be done about that. It would be a very taxing never ending arms race at best. Tweaking the hashing algo every 6 months is something of a never ending arms race, but it's not taxing in that way, it's pretty simple really.