Except that I can control whether the server
I run is up to date, or internet-connected, or has appropriate NACLs, whereas I know firsthand that most large companies do not meet patching SLAs, or have properly-configured security controls.
This is a tech space; if you work around security, you know that someone's home computer is going to usually be harder to hack than a big corporation that has an attack surface a million miles wide.
Maybe I can phish you and get on your machine, but maybe not. But I can definitely phish at least one person at a big company, and usually many more. Your home machine doesn't have an ssh key buried in a git repo's commit history, or in a public S3 bucket, etc.
Most large-scale botnets running on consumer machines target either IoT or routers, both of which are difficult for consumers to patch, so that's more bad business security once again, than bad consumers.
> choose between Google and a free ticket to built vast botnets on perpetually legacy, unmaintained infra
My god, what a false dichotomy. Yes, every computer not run by Google is running freshly-installed, never-been-updated Windows 95, but Google is totally absolutely positively doing better than all the others in the same space. /s