Because you cannot rely on some chintzy IoT device to have dynamically loadable libraries. In all likelihood, they don't. But let's assume they do have loadable stdlib, would would you trust the integrity of your botnet to dozens of poorly designed IoT devices?
But it is easier to copy/paste those few functions rather than play with static libc and then making sure all the other functions don't get linked into the final binary.
