My guess is that they are collecting stats on running HTTP daemon software and thus they estimate that 64% of "cloud accounts" have Apache somewhere, and 51% of the total are publicly exposed instances (not on VPCs and such).

As they make a note that this does not account for configuration, so if you've got the http2 module disabled, it sounds like you are protected — though they only recommend hard-coding the protocol version to 1.1 instead of disabling the module (I've got the module disabled as that was the default when I set up my homelab server, for instance).

I think they’re likely referring to either a Cloud Org (AWS Organisation, Google Cloud Org, Azure Tenant).

Wiz works by plugging their tool into your Cloud Org, so presumably they’re saying 51% of their enterprise-y customers have an exposed instance.