Support costs for shutting down the average user are higher than the costs of bandwidth. Telling someone that their internet was shut off because their device was used in a botnet would lead to very long support calls and escalations.