In most jurisdictions informing them would potentially make them legally liable. The fact they had no knowledge shields them from liability.

So their desire to not be used to commit a cyberattack doesn’t factor in? As long as they aren’t legally liable, it doesn’t matter?

Also a checkbox that says something like “I would like to help commit a crime using my internet traffic” would keep people from having their traffic used without consent.