You're almost never using machines you compromised. Instead, you're using someone else's compromised machines: a botnet-backed DDoS-ing service, which you rented on the open (black) market, at the going rate. Bigger attacks still cost more in such setups—whether or not the botnet nodes were free to acquire, the resulting network is still a scarce resource whose price rises with demand.

(Of course, in the very special case of Krebs, the people he is reporting on frequently are the owners of the botnets, who can of course use their own botnets freely.)