Your chart shows count of each threat for each device reporting. Since not all threats are reported from all devices, if you sort by one threat, the sorting order will be different in other threat, so sorting by Total (which your query does) seems like better option. If that's not correct, could you please explain what's your expected output is, possible with some sample example.
You basically want to order the column of each threat for each device based on count value for each threat. The problem is that they appear in the order of listing in the table visualization and listing order applies to all row. If you sort for each device, the column order will vary for each row hence that won't be possible.
See if something like this is acceptable:
| chart count over device by threat limit=0 usenull=f useother=f
| sort -Total
| fields - Total
| head 5
| rename device as Devices
| untable Devices threat count
| eval Devices=Devices."-".threat | fields - threat
| sort Devices -count