yup, basically every address type except taproot

I think there is like a super legacy address type that doesn't hash the pubkey. This is where satoshi's mining rewards live. If those coins start getting spent we'll know something is up. But as for protecting your own wealth all you gotta do is avoid taproot and use wallet software that follows best practices and doesn't reuse addresses. EZPZ