In the world of auto-updates of software and firmware, even the hardware which is now completely legal and crap-free, could convert itself to a proxy or ad network later any time.

And don't forget about counterfeit products (which look like original but different in firmware) and supply chain attack vectors, which are really, really common.

If you want to buy something as simple as a feature phone, going to a store with 10 of them will give you at least 1/10 chance to buy a phone with a trojan/backdoor.

The bigger problem is convincing them to care. Botnets are abstract - where's the pain to them? Ad farms? That's "just hurting big corporations".

Remember, a significant portion of the population got angry (often violently so) when just asked to wear a mask to protect their neighbors. And the threat there was significantly easier to explain.

I warned them about the risk of those things and showed them what I found, they continued buying the next generation (that person and his two >40yo kids). They NEEDED to watch those soccer games more than they cared about security...