My area of research is primarily post-quantum cryptography, not strict quantum mechanics. That said, based on my understanding of the implementation details of quantum computers (as opposed to e.g. quantum complexity), I’m pessimistic about quantum computers being productively used against real world RSA in the next 20 years. I’d conservatively estimate that it could happen in 50 with a series of breakthroughs.

I think quantum computers will be useful for some applications (maybe even many) and commercially available within the next decade or two, I just don’t think cryptographic breaks will be possible on them until they advance well beyond whatever is first brought to market. You need logical qubits for polynomial-time cryptanalysis of RSA, and many of them. To get these logical qubits, you need so many more physical qubits that it’s not really productive to map our current records (~50 qubits) to what we’d need. In fact, I predict we’ll get to quantum cryptanalysis via a paradigm shift that approaches the problem in a fundamentally different way long before we master the requisite error correction to have enough physical and logical qubits necessary under the current paradigm.