Looks like I misread and this requires RDP to be enabled, which is not the default. But it was pretty common, Rob Graham counted almost one million hosts. https://blog.erratasec.com/2019/05/almost-one-million-vulner...