The point that I was trying to make in my earlier comment is that when we read an article like that we tend to instinctively ask more questions, and if the answers to our questions aren't there we tend to make assumptions. Depending on both our own biases and the biases of the author presenting the information, our assumptions are often way off the mark (in either direction).
Here's some questions I would pose to the authors of that article that aren't answered:
How many hosts are being hacked?
Who owns the hosts being hacked? Have the authors taken steps to inform the owners? If not, what is the reason they chose not to?
What are those hosts normally used for and by whom? What is the scale of the privacy implications associated with NSA/GCHQ/CSEC using this host?
What criteria are considered when they select a host to hack to use as a relay?
To quote parts of figure 18 in the Heise story:
CSECS Operational Relay Box (ORB) ... subsequently used for exploits... 2/3 times a year, 1 day focused effort to acquire as many new ORBs as possible in as many non 5-Eyes countries as possible.
I interpret this as "hack many hosts as possible in a given short timeframe".