You are correct. I stated it as a fact whereas I was just assuming there are vastly cheaper alternatives to AWS to do such nefarious things such as renting machines in a botnet, using dedicated HW that you might have anyway around for coin mining etc.