https://www.wsj.com/articles/once-pariahs-location-tracking-...
However, that is not a botnet.
Those systems cannot, at least not to my knowledge, turn on the microphone in the background and listen for useful blackmail-worthy phrases without alerting the user (like Siri et al are presumably capable of); They cannot subvert the WiFi chip to be a wall-penetrating radar capable of pose detection, heart rate monitoring, etc [0]; They cannot snap random photos, finding out who has anything worth stealing, nor also revealing the shape of their keys for 3D printed replication (ditto audio, at least for the keys) [1][2]; They cannot read your email and SMS messages and take over your bank accounts [3].
[0] https://spectrum.ieee.org/telecom/wireless/household-radar-c...
[1] https://kottke.org/20/08/researchers-can-duplicate-keys-from...
[2] https://www.wired.com/2015/08/this-app-lets-anyone-3-d-print... (not state of the art, but ICBA to go through all the irrelevant links)
[3] https://www.zdnet.com/article/android-malware-can-steal-goog... (old Android example, but even Google stamped down on this kind of thing because it is a threat to the value proposition of a smartphone)