They actually do, just somewhat later than targeted ones. No need to scan whole of internet either, just subnets you haven't violated already. Or use DNS for major targets.

I've allegedly been involved in operating some of the largest *nix botnets ever, and certainly haven't seen anyone do that.

Scanning every single port on /0 simply takes way too much time even with millions of nodes, you're much better off improving your coverage over the common ports and catching new (and old) equipment coming online.

Of course, this wouldn't necessarily be true with the "preauth opensshd 0day" brought up in TFA. Such an exploit would certainly give you more than enough BW to do whatever you want, and break the internet while doing it.