I would have thought that technically speaking, even having the botnet in the first place would count as unauthorised access. I didn't think that intent mattered when it came to the act.
Yes, I would say so. To acquire a "bot" by definition requires you to have obtained illegal access. Otherwise it is just an authorised remotely controlled machine; and the fact that this botnet was hired from criminals compounds the issue I guess.

Given that, having control of a botnet gained in that manner would at least make you an accessory.