Probably not that common
"tens of millions of fax-capable devices globally, such as all-in-one fax-enabled printers... The NHS in the UK alone has over 9,000 fax machines in regular use"
In my experience, fax machines in the NHS are literally just fax machines. They're used for sending copies of medical records to other hospitals faster than a folder full of bits of paper can be posted. Not only are they not clever all-in-one devices, but even if they were they'd never be plugged into a network because there's simply no point - there's no use for making local copies or scanning them in for email or anything, so it would just be more work setting them up than it would be worth.
On the other hand, I suspect the vast majority of those tens of millions of devices have exactly the opposite problem that also keeps them safe - they're bought only as scanner/printer/copiers and are never plugged into a phone line to use them as fax machines. That's certainly the case for the printers at my current workplace.
So overall I'm not seeing a lot of risk. The vast majority of the time someone is actually using fax machines it's because their system is set up in a way that prevents them using email and the device won't ever be plugged into a network, while the vast majority of the time someone is using a multifunction device on a network it's not set up in a way it could ever be used for faxes. The number of people using such a device for both faxes and networked functions is probably rather tiny.