Botnets are also an opportunity cost. A user playing on a social media app is not considering what else they'd do with their CPU work, at that moment. A botnet, of which there are really only a few, do have other uses and potential monetization. We don't need users to do more work than an botnet, just make it cost enough more that it's more profitable to do something else with it.