You are right. CPUs are already useless for mining. Currently, GPUs can still mine their share (but running a GPU miner on a botnet is a risk; computers become very noisy, hot and slow, which increases the detection rate). But as the first ASICs have started shipping (or have they?) this is expected to change very soon, and the only way to make a profit with mining will be with custom hardware. This rules out botnets pretty effectively.
Botnets are usually rented out. So there is an opportunity cost, when the nodes and their computational/network resources could be used for more profitable activities.
