They scan and report what the servers advertise, so normally you’d see a list of services and it’d list versions which have known CVEs (obviously, this doesn’t say it’s actually vulnerable if e.g. a Linux distribution patched it without changing the advertised major version).

The “compromised” tag is only added after some confirmation of known malicious activity. I’m not sure what all that includes but I believe that can be things like 200 responses to known malware paths or a database reporting names used by common malware.

It's not looking for compromised devices, just anything with an open port. Conceptually they are just running an nmap scan of the entire public IP range and aggregating the results in a searchable index.

How up-to-date is it?

They scan pretty regularly and with a membership you can submit scans on demand. Picking a /16 I work with, the oldest full scan is 12/15 and the newest is 1/14 — and I say “full scan” because the oldest hosts show far more recent updates (1/13) for things like the web server ports which had previously been found open.

"compromised" means that it looks like the service was taken over by somebody else. That can mean website defacement (ex. "Hacked by XXX"), database ransomware or any other way that a bad guy can compromise a service.