'Control over the device' in botnets is practically also just the network. Bots are also created due to users being naive, like positioning iot devices open to the internet, running insecure stuff etc The exploit route for RPs is also malicious, social engineering. Get stuff for free. Nobody is actually aware of what they are doing here.

I agree on the superficial legality. Like a share hoster deleting links in stead of content etc.