Why don't we use hybrid RSA and ECC then? Or hybrid AES and ChaCha20?

Software bugs is a weak argument for a new hybrid standard, and doesn't justify the additional complexity.

In his defense, ECC is unusually fast compared to both RSA and current PQ

	▲	rot256 a day ago \| parent [-]
		ML-KEM encaps/decaps is very fast, as fast/faster than EC. It's large, and adding EC does not meaningfully affect the size, but it meanfully affects encaps/decaps time.