The wording they use makes it sound like the attackers compromised some Linode service to gain access to a specific customers machine rather than that customer

The wording they use makes it sound like the attackers compromised some Linode service to gain access to a specific customers machine rather than that customer themselves being exploited. If it was just a compromise of that customer there would obviously be no need for this announcement or resetting of passwords. At the very least they don't know which it was.