I'm going to assume they calculated this by simply counting the amounts of returns filed/logins done during the time the exploit was announced to being patched and wrote them off as compromised.

Maybe the Canadian government should walk down to the CSEC offices and ask them hey can you guys stop conspiring with the rest of the 5 Eyes Alliance to sabotage IETF standards