You are wrong. Over 2k from China and 55 from Germany for example. I see the same distribution on my Servers.

That being said: attributing those attacks to Chinese actors based on IP falls a little short. Proxychains exist and are used.

He is not wrong, in 1st image CN is 2k, RO 56k and DE 26k. Across the graph red and purple lines are much higher

If you take the population into account, it is only 2x more.

Given the Great Firewall of China, it would be a pain to go through them if you have any alternatives.

Attacks will originate from some cross-section of [country with many broadband connections] and [many outdated / unpatched OSes in use]. But no humans in the loop other than command & control, or people wondering why their device is slow / acting up.

<Insert usual suspect here> high up can be read just as "many internet users there, whose PC or other device is infected with malware that tries to spread itself".

As the article states: originating device can be silly IoT device like a router, TV, printer, Ring-style doorbell, etc etc etc. In fact, chance of random IoT device being vulnerable and/or been 'recruited' in a botnet, may be bigger than the same with random PC / tablet etc. Many IoT devices are junk that rarely see firmware updates (if any).