Using tbis logic, it seems equally likely core be could be using sybils, just to stay flat.
Allegedly, 19% of the bitcoin network is now running knots
However, I think I have detected evidence of a sybil attack designed to inflate the number of Knots users
I have annoted part of the "historical nodes" chart available at http://coin.dance/nodes/all
Based on this, I suspect the *real* percentage of Knots usage (subtracting probably sybils) is about 12.3% of the total network -- ~2,710 nodes out of 21,950 nodes.
Still a big deal, but not as big as the current numbers seem to suggest
Discussion
My 2 sats is that both are probably using sybils roughly proportional to implementation share.