The spammers already control botnets of that size. They could duplicate the clickstream data with a few lines of code (it's a simple HTTP request feeding Bing the clicks; the only sticky parts are deciding which Bing IP to send them to and harvesting the per-computer ID it sends to Bing).
In short, this gives them a new service to sell when they rent out their existing botnet.
Then by your logic, they're already gaming Google Suggest. And with Instant Search, that's the holy grail. Who needs to optimize placement on a given keyword if you can just nudge users towards your desired keyword.
Or, what's more likely, is that the respective companies are aware of this very obvious vector and have attended to it.
What makes you assume that no one is attempting that?
Botnets are run off of the computers of ordinary, clueless folks, who might be real Bing users submitting real data in addition to whatever the botnet sends.
I've already linked to an analysis of the actual protocol data submitted by the toolbar and I can see obvious ways to copy and fake it.
If you use only the computers in your set that already have Bing, copy that unique ID and figure out what IP they're sending it to, your data will be identical to that sent by a real user.
At that point, you have to harden the protocol and hope it stands up to reverse engineering, or start spam filtering it (if they weren't already). Maybe they can do a good job of that, but it really lowers the quality of the data they're getting once enough people are feeding them garbage.
SEO types already set up thousands of spam websites to game PageRank. I don't see why this would be any different.
I suspect that they are, and when you can simulate a million users doing what ever activity you want them to be doing then the impact on Google and lots of stuff will change.
Of course my favorite was the Amazon hack of repeatedly putting some item in a shopping cart and then adding in a bit of pr0n (or some other weird combination) so that Amazon would put the other item in their auto suggest product combination.
In short, this gives them a new service to sell when they rent out their existing botnet.