You should read through the search warrant to see the lengths that they went through to get permission from the courts to do so.

Regardless I think it’s an interesting question as well but my position is that if these machines are already compromised I’d rather have them run the “uninstaller” than the victims continue to receive commands from the botnet controller and cause additional collateral damage.