It's hard to believe that toothbrushes run Java. There's just not enough space in them for that. Plus 3 million is a huge number.
[1] https://en.wikipedia.org/wiki/Java_Card [2] https://en.wikipedia.org/wiki/Java_Platform,_Micro_Edition
Of course the availability of multiple OS for these devices reinforces the idea that you can run a lot of things on some very low power devices these days.
At the same time, it's important to understand that JavaCard is a very constrained version of Java. Most JavaCard platforms have no support for IP networking, which would make it an unlikely source of DDoS (besides the fact that it requires relatively specialized developer tooling).
I'm not claiming that you could use a smart card for DDoS (the idea seems absurd, but somebody is probably going to prove me wrong one of these days), merely that if some version of Java runs on a smartcard, I don't find it that unimaginable for a toothbrush to have a good enough chip to run Java, perhaps with enough resources for a TCP / IP stack. Something equivalent in performance to an old, WAP-capable phone that also ran Java ME, perhaps.
While not exactly, small, the first Java product was remote controller with touchscreen...
[edit]
No, Java ME CLDC can run on devices with as little as 160kB of ROM and 8kb of RAM.
[0]: https://en.m.wikipedia.org/wiki/Jazelle in [1]: https://developer.arm.com/documentation/ddi0406/c/Applicatio...