I tried to fact check it also. They talk about a "java-based" os that could have been the cause.

I know java me was a thing and there are micro jvm that can run on microcontrollers but still, it does not add up.

I think a DDoS attack happened (happens all the time) and security "experts" mentioned that these things could come from anywhere, even toothbrush, and the details got lost in translation / used for click bait.