Address reuse accounts for 4.33M BTC: the address has already spent, so its key is public. Moving those coins to a fresh address ends the exposure.
The other 1.94M BTC are exposed by script type: 1.71M in P2PK, of which 1.10M is attributed to Satoshi, and 222K in Taproot.
2/6