Once a Member instance is big enough to be attractive for spamming/phishing/otherwise-exploiting the bot herders will arrive anyway, using compromised Member clients, just as current spammers don't generally pay for the data volumes they generate. Perhaps the entry barrier of charging will keep Member small enough to delay this.