I guess I don’t buy that.

Many non technical people use VPNs to access region restricted content. It is trivial to understand and use.

Assuming this all actually happened as described, it sounds like someone wanted it to appear that these attempts were coming from Russia.