The problem is it takes time to identify them and kick them out. At a large scale, there will be a constant churn of poorly managed and malicious instances getting access to the network and then not getting booted until weeks or months later.