Still open at the last checkpoint.
The old columns can be dropped once nothing reads them, and we can see that no application reads them. What we cannot see is whether anything outside the application does — an analytics job, a dashboard someone built, a script on somebody's laptop. The usual answer is "grep the repos", which finds every reader that lives in a repo.
What would settle it: column-level read statistics over a full month, which would cover monthly reporting. Weekly would not be enough, because the reader most likely to exist and least likely to be known about is a monthly report.
Who could settle it: whoever owns the analytics warehouse, since a dropped column surfaces there as a broken job rather than as an error anyone here would see.
Until then the columns stay. They cost storage and nothing else, and that is a much better trade than finding the reader by breaking it.