A bunch of BLE chips are also WiFi capable, so not ruling out that someone compromised the firmware to enable WiFi functionality, but I wonder how they were able to connect to WiFi to trigger a botnet in the first place.
Quite skeptical of this article, while the premise of the danger of IoT devices still remains, nonetheless.