Take any given server. Log the IPs of invalid SSH attempts to access the machine over 3 months. Plot the IPs on a geolocation.

Chinese originating IPs are the overwhelming number.

I posted my actual data years ago as a response to some comment, but I could just grab my recent logs and nothing has changed much (frequency, outliers, and some volume trading).

While the phrasing may be obtuse, it's a sentiment reflecting reality.

It would stand to reason. China has the largest number of endpoints, and thus is most likely to have the largest number of compromised hosts. I take it you've ruled out the possibility this is a geographically diverse spread of actors taking advantage of poor security practices on the large swaths of Chinese infrastructure in your logs?

China has large numbers of pirated unpatched systems meaning that botnets have large presences in China, regardless of who's running their command and control.

It's also a survival strategy - the counterpoint to 'divide and conquer'.

What happens to a group that doesn't unite or fight back because "Well we're not free of sin either"?

If that’s how the people engaging in these attack see it, I would say the title is appropriate

Are you suggesting that "we" are using the "great cannon" to target "ourselves" then?