My understanding is that the chart by Luke is also showing nodes that do not accept incoming connections...
In other words: Nodes that are only listening and do not forward transactions and blocks.
You have that backward. Listening nodes are that ones that
do accept connections.
Also, whether a node is listening or not is entirely unrelated to whether it forwards transactions or blocks.
Those listening nodes still need to connect to the network. They usually, on first start, will connect to a DNS Seeder and ask it for some nodes to connect to. Generally these nodes are ones that have high uptimes and high bandwidth. The seeder will also record some information about the node that asked it for data in case it is a listening node so that it can send nodes to connect to that node as well. So there are then two ways to get information about non-listening nodes; run a DNS seeder, or operate a high uptime, high bandwidth node that gets lots of connections.
DNS seeding uses DNS because the server typically never sees the actual IP querying it. Running a DNS seed does not really get any useful information.
The data used for the DNS seeder (and also part of the data for my stats) is collected by crawling the Bitcoin network directly. Anyone can do this.