Hey Toby,

Great question. The tldr is that none of the funds are vulnerable in this circumstance:

D) No sats!

When Bob sends 6K of the original10K, the remaining ~4K is actually transferred to a new (change) address. It's no longer in the original 1st receival address, but is instead in the 1st change address!

And the second transaction of 100K is received to the 2nd receival address, which is separate from all of the above.

The real problem is when there are multiple receives to the same address, and at least one spend.

So your example, if the 100K was instead received to the original (1st) receival address (where the 10K was first received), then 100K would be vulnerable as the keys were exposed on the spend of 6K.

Hope this clarifies?