> Clearly it could be added to a botnet
This is why I believe in metered data plans. Certainly not ridiculously expensive ones, but not "unlimited" access either.
If your IoT devices become open relay DDoS machines, it should show up on your bill. I'm convinced it's the only solution that aligns incentives correctly.