That you don’t recognise they exist doesn’t matter because you are wrong.

The attacks on Estonia and Georgia were real.
The access the Stuxnet had/has to SCADA systems is real.
Vulnerabilities in ECUs in our cars are real.

A bottle or a rock or a chair can be weapons, the definition of ‘a weapon’ is and has always been about context and intent as well as potential.

Two Boeing passenger aircraft are probably the most notorious weapons used by anyone so far in the twenty-first century.

As you’ve implied that you think militaries make decisions about desirable capabilities based on thinking “what a cool weapon”, there’s really no wonder that you fail to grok the full scale of infosec today.

Yes it does go all the way down to IDS, firewalls and anti-malware and goes all the way up to NSA and the US Cyber-command.

Perhaps by “weapon”, you could be referring to the actual people. Perhaps you could have people working on ways to exploit existing botnets for the purposes of warfare. But I would suggest that it would be better to have those people working on ways to *shut down* the botnet, than to somehow exploit it. But that would be a defensive policy…

Also, I just want to say I hate the phrase “cyber security”. Puts in my mind images of mechanical men screeching “You will be upgraded!” Can’t we just call it “security”?

A botnet can be used to deny access to just about anything, assuming it can talk to the network you need to target. You can use it to target servers, end users, or intermediate infrastructure. A device (including software) which gives you the ability to deny the enemy access to their own communications, or to intercept an enemy’s communications sounds like a weapon to me.