I'm sure they can make a decent estimate from total nodes and downloads of their OS, along with their own Start9 sales and the number of support requests they get for each OS, along with some other reasonably proxies.

They would track that as a KPI internally, and therefore would be incentivised to be reasonably objective, even it is ultimately an educated guess.

Whether they published the same number as they have estimated internally is another matter.

But no spying is required for an analysis like that.