Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds.

Often a sort of malware that more or less sits dormant until command/control sends a target to attack

edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.