I think using number of downloaded will also count number of build on each commit. Imagine if you have three branch in your repository, each push will rebuild the project (redownload dependencies). If you push three times a day it will download three dependencies three times.
Also, some project include their dependencies to VCS which only count once per build.
I use makefile as the library package dependency [1], maybe like what package.json was in node environment.
The idea is if you want to use the library, you just include the makefile inside your project makefile, define a TARGET values and you will automatically have tasks for build, debug, etc.
The key is a hack on .SECONDEXPANSION pragma of GNU make, which means it's only work in GNU/Linux environment.
It's unlikely that he did it in a single transaction, he more likely split it up over a few days. Even a year ago, Bitcoin daily exchange volume was ~$160M, so he wouldn't have had too many problems.
If the article's writer read this, please add this as one of the reason why FOSS need to move from GitHub.
[1] https://en.wikipedia.org/wiki/Vendor_lock-in