Attacks will originate from some cross-section of [country with many broadband connections] and [many outdated / unpatched OSes in use]. But no humans in the loop other than command & control, or people wondering why their device is slow / acting up.

<Insert usual suspect here> high up can be read just as "many internet users there, whose PC or other device is infected with malware that tries to spread itself".

As the article states: originating device can be silly IoT device like a router, TV, printer, Ring-style doorbell, etc etc etc. In fact, chance of random IoT device being vulnerable and/or been 'recruited' in a botnet, may be bigger than the same with random PC / tablet etc. Many IoT devices are junk that rarely see firmware updates (if any).

You are wrong. Over 2k from China and 55 from Germany for example. I see the same distribution on my Servers.

That being said: attributing those attacks to Chinese actors based on IP falls a little short. Proxychains exist and are used.