That's still a good chunk of traffic, but there's also compromised firewalls, VPNs, and random servers. The device types themselves change as new exploits are discovered. Because Twitter still uses their own data centers they could be subject to various amplification attacks as well. But if what he says is true and it's all coming from one country then that is trivial to block at ingress.

A clear sign Musk should declare a ceasefire, stop posting about Ukraine and enter negotiations on how much of Twitter he is going to transfer into Ukrainian ownership.