Things get crazier once you have one compromised hole-punched device that is behind your NAT/firewall too. You can end up in a situation where you have a local C2 server on your light bulb, controlling a sub-botnet of your fridge, washing machine, and wifi controlled doorbell. It's not unreasonable to think that this could compromise orders of magnitude more devices than the original botnet itself, considering how many things are just saved by their interface not being routable or accessible from the wider internet.
Something I've wondered is how much of an impact large botnets have on other systems they rely on. If you had a million compromised CPUs in a small geographic area suddenly jump from a low power state into doing a massive amount of work, could it cause localized brown outs? Some napkin math says probably not, but it's not something I've heard considered much before.