Botnets do not have magical ability to affect Monero more than any other hash source.
As other PoW based currencies, Monero is vulnerable to 51% attacks, and any adversary who is able to sustainably mine faster than the rest of the network will be able to slowly increase the cumulative difficulty of an attack chain, and thus override a "legitimate" chain. Thus, Monero is vulnerable to any party that can attain 51% of the network hash rate (and, similarly to other PoW curencies, to any party that can attain a significant minority hash rate too, for different types of attacks).
Monero uses the Cryptonight PoW hash, as most Cryptonote based currencies do. Cryptonight is designed to close the efficiency gap between CPUs, GPUs, and ASICs. With Bitcoin, CPU mining is a thing of the past, and the vast majority of "normal people" are thus unable to partake in Bitcoin mining, and, by extension, are unable to have a say in how Bitcoin's blockchain evolves. The intent of Cryptonight is to curtail the advantage ASICs have over GPUs (there are no ASICs for Cryptonight at this time, two and a half years after its introduction), and GPUs have over CPUs, thus restoring the "one CPU, one vote" idea.
Now, botnets are able to commandeer a large number of CPUs, and thus may be viewed as a potential danger to Monero. Botnets are typically composed of low to medium strength machines, and without high end GPUs. They are thus able to sustain a fairly high hash rate, but not so high to reach a majority of Monero hash rate. Of course, this is variable, and it is theoretically possible that a large botnet might be able to reach 30 MH/s (the current Monero network hash rate - if a new entrant was able to bring 30 MH/s, thus increasing network hash rate to 60 MH/s, that entrant would then have about 50% of the network hash rate).
Moreover, if a botnet was able to reach that point, it could either decide to mine honestly and make money that way, or attack Monero (eg, double spend). Similarly to Bitcoin and other PoW currencies, it is more profitable to "play nice", since an attack would cause the exchange rate to drop dramatically very quickly, since the coin would no longer be safe. This incentive is a failsafe, should someone be able to amass that much has power.
50% hash rate has happened in the last, at least for Bitcoin. A single pool reached 50% hash rate (I can't remember the name right now). Yet, no double spend or other such attack happened. This is because that party stood to gain more from continuing playing fair. Of course, this is a bad place to be, but there is yet another incentive to act as a last chance shield against a catastrophic failure.
A separate, though related, criticism leveled at Monero is that botnets mining Monero somehow make Monero "bad". I'll mention this because it is a common canard, even if shortsighted. There are two reasons why this argument does not hold water: first, a criminal using something does not make that thing a bad thing. After all, criminals use cars to get to the place of their crimes, dollars to pay for their tools of the trade, etc. Second, if a botnet is being used to mine Monero, it means it isn't being used for other socially negative use, such as spamming, DDoS, or other. One can therefore argue that botnets mining Monero is in fact a social good, since those botnets switch from a nefarious activity to a positive one, increasing Monero hash rate to make it more difficult to attack by another party.
