There are also regulations to go with the bill passed by the legislature. The proposed regulations are open for comment until Dec. 6 2019. In the regulations, "Household" is given a definition (§999.301(h)):
“Household” means a person or group of people occupying a single
You can't add anything to that: the persons do not have to be California residents, and the household does not have to be in California. When you real the text of the law, you will see that consumers (which by definition must be California residents) have rights to do things, and households do not. So a household cannot demand, but a consumer may – but the rights of the consumer may relate to information that "is linked or reasonably linkable to a consumer or household".
Many California users do not own the device that connect them to the internet, but they are not unprotected (consider for example the person who rents their cable modem from their ISP). Ownership of the device is not a requirement for protection of privacy, under this law. Basically, "device" means "device", not some sub-set of devices.
The definition of "Business" does not say that the computation of threshold values is "only with respect to California". §1798.194 says that "This title shall be liberally construed to effectuate its purposes". Limiting which businesses are subject to the provisions of the law would not effectuate the purpose of the law. So in case of imaginable unclarity (such as the omission of a restriction "provided such devices are owned by residents of California"), the law is not to be narrowly interpreted (as applying only to businesses that deal in information of at least 50,000 California devices), it is to be interpreted liberally. The purpose of the threshold values is to not excessively burden "small businesses". A business with 1,00,000 customers that has only 40,000 California customers is not a small business, it is a big business with a small presence in California.
Since there are 6 weeks left on the rule-making process, it is possible that the regulations will change and the AG will interpret the statutory requirement as saying that the numbers of households, devices, or income threshold are only that which comes from or is in California. I am betting that that will not happen.