On the one hand, blocking Chinese and Russian IP addresses is and has for a long time been a very efficient way of drastically reducing intrusion attempts. Like it really works.

It's not perfect though: Botnet activity isn't going to come from any particular ASN, but a wide array of unpatched smart fridges and compromised enterprise routers all over the world, so it doesn't crop up in this type of analysis.