The infrastructure needed for this is now fairly mature: you can rent botnets rather than build your own, infecting devices is relatively plug-and-play, device

The infrastructure needed for this is now fairly mature: you can rent botnets rather than build your own, infecting devices is relatively plug-and-play, device security has only improved marginally and for a shorter timespan than the useful life of the devices (i.e. so there are a lot of vulnerable devices out there.) That's just a few relevant tidbits on the technical side of things... the social/people side is even worse. So you no longer need to have a great deal of expertise or expend much effort to do these kinds of attacks and it sounds like organized crime has gotten in on the game in the past decade.