Sessions != Users. I have two or three active sessions at any point, Multiple browsers + mobile. Since the issue seems to be with cookies, we can probably discard mobile.

Also each time you login/ token refreshes is probably a new session. So they easily have million's of sessions daily. So in the one month period between 6th Feb and 5 March, you have

  **(DAU) * 35* (average sessions / user)** . 

So in the ballpark of 10M * 35 * 5 sessions ~ so anywhere between 700-1500 M sessions conservatively . That is in the ballpark of 15,000 users.

Also 0.001% is their belief of the impact. I don't see any evidence or statistical model or details supporting the statement.

I am deeply skeptical of this number without knowing the methodology , as you say it would quite impressive to narrow down a race condition to that level.