Correct it is of the staked Ether not total supply. It's an important detail of course and easily missed, a good way for future people stumbling across here to think about it is that any attack only involves those participating in consensus. For Bitcoin consensus is mining. For the beacon Ethereum chain consensus is staking, therefore only staking Ether is relevant.