It would, but switching the use case from a 'normal' pattern to a hijacked pattern may need an order of magnitude more traffic and as such, more coins. But coins (or mining resources) are a limited supply, so this means the DDoS or spam could only work if the botnet will keep the volume of illegitimate traffic equal the replaced 'legitimate' traffic. This may cause some alarms.

But ultimately, your argument is: if one system can be cracked, a more complex system could also be cracked.