I think segwit addresses are safe from long range attacks because they have another layer of hash

i think i get your point. segwit wraps pubkey around two hashes, sha256 and ripemd160, whereas taproot does not but rather commits to tweaked public key with bech32m and it reveals its tweaked pubkey to scriptpubkey field directly. That may be one attack surface even to the unspent taproot output??

Thanks for the link, I’ll take a look.