the malware likely targeted millions of Linux servers in recent years and possibly caused infections in several thousands of them.

As long as the success rate seems to be that low I am not sure I would consider it wide-spread. A few thousand servers could literally just be a few dozens admin organizations each running a couple of hundred servers badly.