From the actual report:

"Over the past few months, we identified and analyzed more than 90 malicious applications uploaded to the Google Play store. These malware-infected applications have collectively garnered over 5.5 million installs.

Recently, we noticed an increase in instances of the Anatsa malware (a.k.a. TeaBot). "

So not 5.5M installs of this specific malware, FWIW

They tried it way before 2020 too, they talked to the agency I worked for at the time. Same result

Their CEO probably has a non-disparaging clause in his contract or exit agreement

What does this partnership mean though, other than a blog post? Do they plan on changing the default search engine in FF?