What is his solution to combatting botnets at scale?

His solution is don't. Why would you? In fact, if you don't block the script that's running on one computer, the script operator won't need to run it on a botnet.

I don't know RMS's solution to spam or DDoS which are the real problems.