Also, "including possibly through Wikileaks" means nothing. "Including possibly through my second cousin's DIY basement mail server."
I don’t know if there was further evidence not made public to protect sources and methods.
A judge famously said you could indict a ham sandwich. In practice, grand juries say whatever a prosecutor wants them to say.
And as Russian nationals, it's also unlikely they'll ever have to actually stand trial, which is when evidence would be required to enter the public record to convict them.
Either you "protect sources and methods", and not make strong public accusations, or you make accusations and disclose evidence.
Doing one but not the other is indistinguishable from just making false claims - which the US is known to have done repeatedly in the past (another example - Gulf of Tonkin).
But it seems not an unreasonable guess in this case that there was possible use of "WikiLeaks's private communication system" based on a Twitter DM that was quoted in the Mueller report:
On September 15, 2016, @dcleaks wrote to @WikiLeaks, “hi there! I'm from DC Leaks. How could we discuss some submission-related issues? Am trying to reach out to you via your secured chat but getting no response. I’ve got something that might interest you. You won't be disappointed, I promise.”