Amazon security experts took a closer look at the flagged ‘U.S. remote worker’ and determined that their remote laptop was being remotely controlled – causing the extra keystroke input lag.

With access to the final remote desktop, and access to the workers laptop you know the delay from these two so if there is more delay, then you can infer it’s coming from somewhere else? I’m sure there are more paths too but access to the North Koreans hardware doesn’t seem required