If you take a closer look at the paper, then you will notice that the methodology to detect infected people was based on studies which tested more or less randomly selected people for antibodies against SARS-CoV-2, looked at the percentage of people with antibodies, extrapolated that number to the whole population of the region from which the tested people were drawn, and then compared that to the reported number of deaths from COVID-19 in that region.
The assumption is that anyone with antibodies already had an infection with SARS-CoV-2, but might not have realized it because they were asymptomatic and there was no reason for them to get tested during their infection.
This is based on a couple assumption which might or might not be true:
- The antibodies measured in these tests are actually from a SARS-CoV-2 infection and not from an infection with a similar but less dangerous virus (there are lots and lots of coronaviruses, and many of them are not nearly as dangerous as the Coronavirus SARS-CoV-2)
- The antibodies detected are sufficient to prevent a(nother) SARS-CoV-2 infection. (Cases of people getting COVID-19 twice are so far rare, but not unheard of)
The official numbers you can see on various COVID-19 dashboards (like the one from the John Hopkins university) list only confirmed active infections vs. deaths. With that methodology, you come to a fatality rate of ~2% with regional differences ranging from 1% to up to 10%. These regional differences can be explained by prevalence of testing (less testing usually means only obviously sick people get tested and reported, who are usually people who are less likely to survive) and quality of health care.