In a dumb miner - pool model the fact that the miner doesn't do the workload doesn't mean the workload doesn't exist.
One getwork is ~400 bytes. Some have speculated mystery has 1.8 million nodes. To use a traditional full pool server the bandwidth requirements alone would be 5.7Gb and 1.8 million connects every long poll.
The getwork size is the same, whether transactions are included or not. The quantity of getworks is the same too, whether or not transactions are included.
If your calculations prove anything, then that its not a botnet. "Because its too difficult to manage even a moderade sized botnet (ask Tycho)" - your own words paraphrased.
The fact that transactions are not included does not add one single jota of support towards/against the botnet theory.