shouldn't taproot addresses be frozen too because of the exposed public key addresses?

Yes, BIP-361 covers all existing locking scripts since none of them use post quantum cryptography.

That's not a conundrum at all. Permissionlessness dictates that both are true: you can't force anyone to use their coins in a particular way, and it also dictates you can't *stop* people using their coins in a particular way. Forced upgrades to security are a valid way of doing this if users don't have an expectation of autonomy. Bitcoin users do, and must, have that expectation. No auto-updates. Also, rational economic interest dictates against your proposal, because it destroys bitcoin's value.

The voluntary nature of the protocol also dictates that anyone can choose to reject transactions with characteristics they deem dangerous / insecure. I think you'll find your final claim to be controversial because some see it as value destruction while some see it as value preservation.