Ehhhh, there was a lot of incentive to botnet vulnerable machines.
Source: I made a lot of money between the ages of 12-15 running HijackThis and Spybot Search and Destroy on neighbors' machines.
Other source: circumvented my school's firewall with "anonymous proxies" on lists of what, in hindsight, were absolutely compromised machines.
There was a lot less incentive to be malicious. No crypto-mining on compromised devices, no ransomware, and limited Internet banking