a lot of them are written in assembly or C to keep the binary size as small as possible.
It's not about the size, but about external dependency.
Malware is usually written in Assembly or C to minimize external dependency. If a malware is written, let's say, in .Net Framework 4.6.2, and the victim runs Windows XP, it will not work. This is why authors remain mostly with C libraries, as they are usually installed on every computer they want to infect.
A small executable written in Assembly will load and execute way faster than a large executable made with ElectronJS, for example. This maximizes the amount of time the malware can be run without the user detecting something amiss. A large malware consuming lots of memory will stand out if the user goes to Task Manager and looks at the resource consumption.
It will demand way less infrastructure from the C&C servers, so the attackers can rent a cheap hosting server and infect a lot of users, or compromise another server to host the malware. A small size means the owner of the compromised server will not detect the infection for a longer time. A large, 100MB malware being sent to thousands of users will alarm anyone taking care of the server.