I think people mash all 3 control keys with the left hand and reach across for the 5, or stretch their fingers very awkwardly and do all four. We’re into Rachmaninov territory at that point.

One can also invoke the query-regex-replacep functionality by its name instead of the key sequence C-M-%. For example: M-x q-r-r Tab Enter. The Tab key autocompletes the partially entered name q-r-r to query-regex-replace. This is going to be a lot more convenient for those who want to avoid the four finger chord.