You are missing botnets of GPUs.
Honestly, I do not think botnets are such a big problem. Botnets succeed because they are invisible to the victims (some trojans even include an anti-virus to clean the system). If an infected computer has 100% CPU usage, it will not stay infected for long. Stealing credit card data is still a lot more profitable than running a crippled mining botnet.
So I would say that the scrypt key derivation function, from nealmcb's answer at your other question, is be a pretty good choice.
