Contra on Nostr: Depends which exposure you mean. Taproot addresses put the actual pubkey in the ...

Depends which exposure you mean. Taproot addresses put the actual pubkey in the output itself, so receiving funds exposes it immediately, no spend required. Legacy P2PKH only exposes the pubkey once you spend, since the address itself is just a hash. So Taproot exposes earlier, legacy exposes later but has had way more time and reuse to accumulate exposure. Different clocks, same eventual problem.