Well, there would be the overhead, so more ideally you'd be submitting such requests to an out of band network (possibly forward to such a CnC network /by/ the routers along the way).

The command and control network would authenticate the source request via some means and if it's authentic act accordingly.

The benefit of this is that it also allows for identifying infected or otherwise abusive customers and actually being proactive about getting them cleaned up.

Of course all of that degrades the 'customer' experience, and costs money. Both of which are probably why no one does this right now.