He doesn’t know the exact mortality rate, he doesn’t know the exact time from infection to death, he doesn’t know the doubling time of cases, he doesn’t know the effect of social distancing.
He applies decent guesses at each of those critical unknowns and runs the numbers. Process is fine but he is still drawing conclusions on several guesses.