Yeah, people are obsessing about the extra entropy keys being at risk but hackers are probably obsessing more over fringe derivations before they start to go after <5 dice roll variations or <5 letters passphrase single sig coins. Sure, those might get found eventually if you don't move them but in terms of CPU/BTC there's still lower hanging fruit out there. The first wave skipped taproot completely. The next skipped wallets that had a slightly higher gap limit. I bet they still didn't empty the secondary accounts or accounts past account gaps.