The content and tone of the article gave me the impression that they believe they know the scope of exploited devices. This implies knowing something about which devices were exploited or at the very least which subset of devices were vulnerable where the majority weren't.

  attack was narrowly focused, not a broad-based
  exploit of iPhones “en masse”
  
  “mass exploitation” ... This was never the case.

If they don't, then they really shouldn't be making claims that the exploit wasn't widespread. They really don't know one way or the other. Otherwise, they could have notified those that were vulnerable / exploited.