I've done it at the scale of a few hundred and I still feel I've seen more than enough to 100% agree with you.

I've seen customers max out gigabit links with outbound spam from a compromised desktop. Contacting the customer leads to ignored emails and unanswered voicemails at best, angry Facebook rants about "getting in my face" at worst.