Quote

That's a false assumption. Take a look at SegWit, even though P2WPKH exists and it is more beneficial to use it, a lot of people still don't.

People are not forced to use Segwit. In case of breaking ECDSA someone will move that coins: the true owner or the attacker. There is not much that can be done to protect funds, P2PK outputs could be moved directly if ECDSA is broken, P2PKH and P2WPKH outputs will be safe if public key is hidden, the same with P2SH and P2WSH, but that key have to be revealed in some safe way, which could be hard. For P2TR outputs spending with a script could be mandatory, but that may not be enough. The whole Lightning Network is based on raw public keys, known for both parties forming a channel, so in case of breaking ECDSA any such second-layer network will have to switch or all coins will be taken by someone.

The difference between Segwit and breaking ECDSA is that in Segwit you can switch or you can still use old version and pay fees for that choice. In case of security issue, it is more similar to Value Overflow incident: you can stick with the old version, but it can quickly become worthless, forcing you to switch no matter what. In reality it depends how hard it will be to break ECDSA: 2^64 operations?, 2^32?, 2^96?, as long as mining a new block is more profitable than attacking some existing address with huge balance, we are safe.

Quote

In case of a security concern, there is an additional problem that you can't say the system as a whole is secure just because SegWit version n is secure and everything else (in this hypothetical scenario) is insecure.

In the currently existing system there are insecure scripts you can use if you are a miner, for example "2 2 OP_ADD 4 OP_EQUAL", you can also lock coins to a hash of something with no keys, that could be captured by other miners. Is that system insecure, because it is possible to do so? No, because that scripts are nonstandard, in the same way the future system will be secure if creating new insecure outputs will be nonstandard (and when all such outputs will be cleared, then spending such scripts can be nonstandard in future versions).