IPv6 space is too big to scan, a /64 network is already a big problem. Botnets require vuln device to have internet connectivity, they don't need to have inbound connections. Most of them use udp/dns etc. for control.