I would prefer it be measured in size of botnet. Criminals don't use EC2. They use hacked boxes. They have no cost beyond compromising the machine.
If EC2 can collide SHA-1 with $75k of rented GPU time, imagine how trivial it is for an organization willing to buy $100k of dedicated GPU compute hardware to devote to colliding SHA-1 certificates. You don't even have to botnet once you have enough working capital.
Never mind how trivial it is for an organization like the NSA or GCH to do this sort of thing with their existing hardware.
Using a botnet for compute has opportunity cost attached to it. However, I have no idea about the usual prices when they are rented.