clearly pay to pubkey is still currently safe or there would be 4 million bitcoin getting stolen out from those vulnerable addresses :)

The cost to attack vs the value of the target is the most important metric. If the shitcoins have enough swappable value, they will be attacked as well--and actually maybe easier targets because most people won't care if some random crypto gets hacked--the bitcoin crowd won't necessarily think we've hit a point where these attacks are possible, so if I were an attacker, I'd probably start liquidating alts before hitting bitcoin.