The root user is not an IAM user and probably is not counted among those statistics. Enumerating IAM users won't include the root user, so it depends on how exactly they got that 40% metric

(Root user ARN is arn:aws:iam::555555555555:root versus IAM users which have ARNs like arn:aws:iam::555555555555:user/USERNAME)