> What would happen if (when?) someone with more evil intentions decides they would like a 420,000 device botnet of their own?

If you read into the details, you'll realize someone else already did: the Aidra botnet. The author spotted them pretty quickly, and took some steps to prevent their spread.