You resell a game, bundling a botnet proxy inside, and make it freemium: free if you accept T&C with a service allowing using your device connection for research purposes (or whatever wording could be even more confusing), or pay $20.
It's no longer a botnet, it's a "residential proxy" and you are doing clean business.
"User accepted T&C" is enough to get away with almost anything. It works very well for top IT companies. Upholding new business to higher standards would be unfair.