Id assume a bot-net would go for large offices/companies, where people would be unaware of the extra pc usage.
Large offices/companies wont have very powerful GPU's if any at all.
It would be easier to organise a CPU botnet than a GPU botnet, because i can farm large amount of CPU power from "large" companies, but with GPU i would have to gather from individuals, which would be harder.
Large offices/companies are probably running a bunch of shitty old Celerons, I don't think it's much of a threat. And any company that happens to have rackfulls of 14 core Xeons is likely to have a sysadmin that
just might notice the sudden massive load increase or their atomic weapons simulation or HFT algos grinding suddenly to a halt and various red strobing lights and ear splitting sirens going off.
Botnets are more myth than reality in cryptocurrencies.