Also, P2PKH already prevents early exposure. Right? So as long as an address is used only once, it is safe until the bitcoin transaction is created to spend the utxo. (So short window before confirmation that it's vulnerable. So essentially only a window for (near-)real-time attacks.
That's my understanding of the situation, at least.