The botnet would need many years for reaching a 50% probability of key collision.
Many millions of years.
It's not impossible for a collision to be found, but there's not enough profit in it. Even if someone can find one address every hundred million years, all they get to spend is the balance of that one address. This equates to an averaged cost of fraud of way less than a millionth of a cent per transaction.
It's not worth worrying about, when any simple trojan or social engineering attack is sure to net a few wallets.
Many trillions of year. It is not possible.
Highly improbable. Not impossible.
Let's assume you can gen and encode 2500 pubkeys a second with known privkeys. Right now that's this many days to exhaust the entire key space:
536074487209797201035050856521703277098472151229817426108599925962560.8
or
1468697225232321098726166730196447334516362058163883359201643632774.1
years
Now let's assume you can make that 50 times faster ... then it'd take this many days:
10721489744195944020701017130434065541969443024596348522171998519251.2
or
146869722523232109872616673019644733451636205816388335920164363277.4
years