[stratom]

The field is too young that we can be absolutely sure. That's why most suggest to use hybrid cryptography for now.

[BoppreH]

True, and hybrid cryptography is definitely the way to go.

But there's more to it than just resistance to cryptanalysis: crashes, memory leaks, disabled security features (e.g., ASLR), irregular performance, supply chain attacks...

PQC requires extra code, and every added instruction carries some risk.