And his limiting it to "virtually every potential theater" would suggest that it's mostly present in Lebanon, Syria, Iran, Yemen, most likely Iraq as well.

But let's be honest here, this isn't civilian equipment that's been compromised. It's supply chain attacks where the buyer is manipulated into buying goods that they've tampered with, or re-engineered. They weren't pagers anyone could pick up at Radio Shack. (Everyone who got hit was a target, or a direct relative of a target.)