I'm not sure about the way botnets are working, but they have to create a worker in order to mine, no ? As their actions are automated, if the creation of a worker is protected by something only a human can do, they can't do it, so they can't mine.