They make an "educated" guess...
Actually it is a mathematic trick, sort of making up the numbers without totally pulling them out of your arse, since it is impossible to count the number of pirated OS or the number of pirated apps running on either legal or pirated OS.
For OS is relatively simple. You can get a pretty good approximation on the number of computers sold, either full or in parts, simply by learning the max number of motherboards (using processors would be trickier, since there are MB that support multiple processors). Since you know how many computers “may” exist in the market of a country, then all you have to do is add up all the known numbers for legal OS sold, preinstalled or in the case of distros like Ubuntu, how many downloads are there (you can even be more precise by checking how many computer download the updates for these OS as to prevent double counting people that downloaded the same system multiple times). You compare those figures and you get a good approximation of how many pirated OS are out there.
Now for apps, like games, is way harder. In fact the numbers are probably overblown by an order of magnitude if not more. There are only 3 sources to make the guess and all are way imprecise, 1 is monitoring traffic for downloads, witch with p2p programs is crazy; 2 is checking local authorities estimates on street sales, with is even more crazy; 3 is the estimates of a publishers for an app sells compared to the actual sells compared to the estimates of the people using the app, this is total BS from all angles. There is tecnic number 4… spying, but this is just as unreliable and quite illegal if I am not mistaken.
In conclusion, it is all pretty inaccurate, probably with an error way over 10% (I am totally making that number up, but who isn’t?). It would be sad if publisher actually believe it is thanks to their DRM policies that piracy “is picking”, cause is not, remember, all it takes is a single lonely cracked copy for the floodgates of piracy to be open wide, and it takes like 48 hours in average to crake the harder DRMs… so make the math…