Yes, this strikes me as another case of looking at the current adversarial dynamic, solving a problem, then assuming that the problem will stay solved because your opponent will just throw their hands up in dismay and say "Alas, I am defeated!"
This is not usually what happens.
While it is basically true that having so many addresses does make the old way of just scanning the network ineffective, there will still be ways of getting at least some addresses. Look in connection logs of any kind. Leverage other protocols, like email addresses, which are every bit as imperfectly discoverable (but discoverable!) in IPv6 as IPv4. For instance, send an HTML email that ends up requesting something.
Besides, it seems to me the botnet attack methods are already no longer based on randomly scanning the internet and hacking Windows; they already work on email, the web, and social engineering. IPv6 doesn't do anything about that (nor can it).
This is not usually what happens.
While it is basically true that having so many addresses does make the old way of just scanning the network ineffective, there will still be ways of getting at least some addresses. Look in connection logs of any kind. Leverage other protocols, like email addresses, which are every bit as imperfectly discoverable (but discoverable!) in IPv6 as IPv4. For instance, send an HTML email that ends up requesting something.
Besides, it seems to me the botnet attack methods are already no longer based on randomly scanning the internet and hacking Windows; they already work on email, the web, and social engineering. IPv6 doesn't do anything about that (nor can it).