> Wouldn't it be costing the attacker some amount of money running the C&C server?

Not necessarily. They could configure the C&C to run off of something like pastebin/gist where they just input a list of IPs to attack and the botnet checks a specific url every X minutes for new instructions.