At least with a Pi you can install the latest security patches. Of those millions of phones, many are simply locked, and even the others very often don't have drivers compatible with the newer kernels.
Becoming a node on a botnet to save $5 is not very attractive.
That's true. There may be some help with the new Android HAL stuff, but the older phones are probably out of luck because the chipsets might be obsolete and thus not need new drivers to be released for them.
That said, RPi still has one or two binary blob driver holdouts as well, but I agree there is a world of difference between them in this respect.
The slides are light on details, but if I were doing this, the phones would not be running Android in any case, so while security is an important consideration, you can't just say "but security!" and toss out the baby and the bath water.
Becoming a node on a botnet to save $5 is not very attractive.