Thanks, both points taken. On the compromised key you are right: our data is about keys leaked long before migration, which is not the case the section covers.
On accounts that are not delegated today, here is a first number. Over the last 3,000 mainnet blocks (to 117,639,095, about 20 minutes) there were 822 distinct senders: 94.2 % plain EOAs with no code, 5.8 % delegated, none with contract code. Of the plain EOAs, 500 of 774 hold at least 0.1 MON, enough to send the single type-4 transaction that delegates and adopts. So the active accounts mostly can take the self-sent path; the 80 % of delegated accounts without MON are the sponsored ones that never send their own transactions.
A 20-minute window leans towards bots; I can run it over a day or a week if that helps.