There’s no way ISPs can function without SNMP. I think network management is like a 1/3 of all traffic. We process billions and billions of traps daily. These are not on internet connected networks and some have dedicated channels.

How did the attacker get the community string?

1/3 is a absurd, more like 1/3000.

Most people never change it from "public" you know.

Bonus: if the "private" community is exposed on Cisco IOS, you can read and write the router's configuration.