To prove a point- the current system of law is completely broken when it comes to dealing with malicious software. Law enforcement is a joke, to the point where reporting a botnet c&c located right in the US to the FBI will result in a six week run around before you finally get a phone call from someone in the right department, and this is assuming you've dealt with them enough to be on their quick list. Guess who moved their servers four weeks ago?

Actually taking matters into your own hands, as an individual or a company, opens you up to a ridiculous level of liability and is probably illegal in a number of cases. Hell, even analyzing malicious software itself has the potential to be illegal due to draconian copyright laws (fortunately most malware authors aren't willing to claim owner of their software, so this isn't an active issue). Even once all that is done, more malware will be written, and probably by the same people since it's not like taking the botnet down actually puts people behind bars.

This isn't to say the bad guys are winning- I may be a bit bias (I work for Malwarebytes, although this post is my own rambling mess), but a lot of technological strides are being made. There is still a fair bit of frustration out there with law enforcement though, as they continue to impose draconian and orwellian systems but haven't implemented the low hanging fruit in policy changes for actually dealing with this crap.