Also, being part of a botnet should directly impact your internet bill. I don't really see another option. It's a bit silly that nobody knows when their devices are saturating their bandwidth 24/7 because they are compromised.

That way people are then motivated to hire a professional. Also, people making devices will be motivated to not use a default "admin" password because customers will start saying "uh, this smart toaster cost me hundreds of dollars when I plugged it in."