With the recent hardfork it was proven that not more than 10% (+-5% for more accuracy) of the hash rate is botnet.
They're probably all just temporarily mining eth till the bubble implodes, or some other random coin in a bubble.
Or maybe the botnet theory was shallow reasoning (CPU-friendly alg, therefore botnets) and wrong (or at least exaggerated) all along.
In 2014 there were loud and frequent claims of the mining being botnet-dominated. Well it turns out that was in time proven untrue and most of the mining was being done with cloud computing (verified by at least two sources).
Yes there are botnets but they don't really have zero cost, and seem to be a limited share of the network. The more mining is done in a bot node the more likely it is to be disinfected by its owner. Other uses of botnets may have a better return on investment, and putting mining on such a node increases the attrition rate (i.e. depreciation cost) and may therefore be unprofitable. Many bot nodes are older and inefficient, and have a very low hash rate even before factoring in the necessary throttling for stealth (and certainly after). The current network is about 60K mid- to high-end desktops (or a slightly lower number of midrange GPUs). As bot nodes that would be hundreds of thousands or millions. If such botnet(s) existed it would be making headlines. It probably doesn't exist.
Empirically mining is reasonably profitable even if you pay for electricity (with some combination of low rate and/or efficient equipment). If there were a lot of botnets with 'zero costs' the difficulty would be driven higher (which might even be a good thing from a security perspective). Botnet mining capacity seems somewhat self-limiting, for better or worse. So, again, such botnet domination of mining probably doesn't exist.
All of which was true even before Eth, btw.
Also, at the present time mining is a rather small portion of market activity, something in the neighborhood of 1% of daily trading volume. Speculators and holders are much more important market participants now.