Based on the article it seems like they got the number from IMEI activations or something along those lines, not via phoning home to Apple-ran services (since then they could have gotten iPad numbers as well)
> While some devices like Wi-Fi iPads won’t show up on carrier networks, which Apple says makes the total number of stolen products higher.
activation lock is an apple ran service. At first i thought they got the data from the carriers and that sounded very ridiculous. That's what confused me.
> While some devices like Wi-Fi iPads won’t show up on carrier networks, which Apple says makes the total number of stolen products higher.