Seems pinned on some random employees. How much risk is there that criminals will "buy off" employees of large software companies to build out a massive botnet

Seems pinned on some random employees. How much risk is there that criminals will "buy off" employees of large software companies to build out a massive botnet? Are malware profits high enough / deniable complicity easy enough / the number of employees who could do something like this around the world large enough that we should expect this sort of thing in the future?