Surely the botnet operators and the authors of the original infection program knew about the risks of not using any authentication for communication between clients and servers? If anything, they are probably surprised they got away with that flaw for so long.

Maybe the people writing botnet apps have the same pressures as legitimate companies, where the "bizdev" guys tells the techies to ship unfinished garbage just to have the next version out the door, and the bugs and security holes be damned. :)