But as far as I know any transaction needs to have the private key signed to be spent, so does this mean that all wallets of all types are at the same risk when spent from? And does this also mean that the wallet is safe as long as it is not spent from?
The issue stated in OP is about an attacker (hypothetically using quantum computing) gaining access to an address using known public key (PubKey) information, since any new addresses except P2PK "hide" its PubKey behind hash, the attacker won't be able to know its PubKey as long as it's unspent or hasn't signed message publicly as @ABCbits said. Without known PubKey, no risk of such a hypothetical attack.
The issue isn't about cracking hashes, brute-forcing private keys, etc., only about "cracking" known PubKey. And since all addresses use the same secp256k1, AFAIK pretty much they are the same*.
*Except for Taproot, couldn't comment about it, since I'm not familiar with it.