Sophie Schmieg (head of Google's cryptography team) has a good post answering this: https://keymaterial.net/2025/12/13/a-very-unscientific-guide...

She also notes, as a side remark in a different post: "I would say that my trust in lattice cryptography is pretty much equal to my trust in elliptic curves, and quite a bit higher than my trust in RSA." (https://keymaterial.net/2025/11/27/ml-kem-mythbusting/)