Bot activities do not necessarily have to be illegal to be malicious. If the activities violate a website’s terms of service, or robots.txt rules for bot behavior, they qualify as malicious. Whenever a bot engages in acts such as identity theft or account take over, they should be viewed as malicious.
In the case of DDoS attacks, bots are used to create excessive traffic with the goal of overwhelming a web server's resources. This may be with the goal of disrupting operations or preventing legitimate traffic from reaching the server. In either case, the bot activity is clearly malicious in nature.
When DDoS attacks are launched using a botnet, the fact that each bot has its own IP address (often without the device owner even knowing their machine has been hijacked and is being used for an attack) makes it difficult for the targeted server to recognize it is being subjected to a coordinated attack. This also makes it difficult to block the source of malicious bot traffic.