No major social media site publishes estimates on bot activity, so unless someone is citing a research paper with a reasonable bot-id technique, they're speculating. That said, there are a few useful things we can say with only modest speculation:

1. No commercial social media site has as trivial a sign up process as these instances. They had no email verification, no captcha, and no validation or gating process of any kind. Scripts created this users with a single API call, hitting it as fast as the server would respond. So on the account validation front, reddit does better than these instances of keeping bots out.
2. Every commercial social media site has a security team that attempts to monitor bots and has the capability to remove them. Some of these admins were aware of the signups, and others didn't know how to respond. So on the monitoring and response front, reddit is more sophisticated at detecting and responding to bots.
3. These instances I believe had zero or one active users vs 100k+ bot accounts. It's hard to say what the bot rates are on commercial social media sites, but I think we can confidently bound it to something lower than 100k to 1 in favor of bots.
4. The aggregate number of bots represented about half the total lemmyverse. I'm sure someone will disagree with me, but I would be pretty surprised if half the signups at commercial sites are malicious. But that's more plausible than 100k to 1.
5. But one the other hand, the activity of these bots is public, and they demonstrably didn't do anything. At least some of the malicious/clandestine bot accounts on commercial social media sites are active... so maybe here Lemmy gets the win since this massive wave of bots went unused. Now, that doesn't mean that OTHER more sophisticated and undetected bits aren't active on Lemmy just as they are on other social sites. But my bet is there is little to none because Lemmy doesn't matter enough to be worth attacking by the people who are able to run sophisticated bots. But this is hard to prove one way or another.

TLDR: This signup wave was so unsophisticated it would never have been possible on a major social site with a security team. But it also didn't do any altanfible damage, unlike clandestine bot activity on major social sites. Depending on what metrics you use to compare (and how made up your metrics are, since this is all about activity that attempts to stay hidden), either side can come out on top.