Also, let's just assume that a bad actor would have access to reasonably sized and geographically distributed botnet... they could easily run their own global connectivity tests to get a good picture of what the actual impact of their actions were.