Actually no, in this case it's directly measured. Quantcast only shows exact stats for sites that include their JS tracker. Sites normally do this for advertising purposes (advertisers don't have to wonder about your traffic).
When I worked at reddit, the shakedown worked something like this:
1. ComScore (or one of their competitors) makes up a small number and tells advertisers that's your traffic
2. Advertisers believe them
3. You call up ComScore and say, "WTF?"
4. ComScore says, "Well, if you don't like the numbers we're reporting, you can just add our tracking bug to your site"
And then you're in a position where you either have to betray your users' privacy by putting a third-party tracker on every page you serve, or have your traffic stats dramatically underrepresented to the advertisers you rely on.