Not sure, but: median certificate (so each CRL has a multiplicity of however many certificates would use it, or perhaps of how many times it is actively retrieved) vs median CRL size (each CRL listed once)

Or they meant mean for the first one, I guess.

Edit: it's the former, from the paper:

We immediately observe that half of all CRLs are under 900 B. However, this statistic is deceiving: if you select a certificate at random from the Leaf Set, it is unlikely to point to a tiny CRL, since the tiny CRLs cover very few certificates.