A Guide to Post-Quantum Cryptography

As of the current state of the art: yes, that's correct. Isogenies are slow with very small key sizes; lattices (and Goppa codes) are fast with large key sizes.

Isogenies are a good use case for e.g. constrained hardware that doesn't have much space but can tolerate longer key exchange turnaround times. Conversely you'd really want something like lattices for typical key exchange between a client browser and web server.

Code-based solutions have similar advantages and disadvantages lattices and are much older. McEliece is only slightly older than RSA. But because the structure of most types of error correcting codes, it has been very difficult to develop safe systems with the same versatility as lattice based systems. Code-based systems have fewer intractability problems available and virtually all types of codes tried to date have been broken - see research over the past two decades by Nicolas Sendrier, for example.

The issue is that finding a class of sparse matrices that don't ruin the security guarantees is really tricky. This more or less is the approach that ring-lwe takes - the matrices can be represented as polynomials and therefore are only linear in the security parameter, not quadratic (it also speeds up all the other operations via FFT-type techniques). But even there you have to be really careful about how you're constructing these polynomials, which boils down to a bunch of fancy algebraic number theory.

Useful archive of papers, but pretty dated at this point.