The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.
Wrote the blog post myself, and used AI to clear up typos and occasionally improve wording. I have a PhD in computer science, but I was initially planning to pursue journalism instead, so I like to think that I can write good :-).