And yet experience shows that GP is correct. The vast majority of mailicious traffic originates from those countries IME.

Only stuff like scanners and other basic stuff (that comes from devices that have been left unattended and without updates). But the actual malicious traffic is not that easy to spot, as it won't be router directly.