I believe, for bitcoin, that only works to spend coins from addresses that have already been used to spend coins, which, is therefore discouraged as a way to hold bitcoins? Instead, best practices are to, when sending from an address, to send all the unspent coins to addresses that have not been sent from yet. This does make things marginally harder for providing an address for people to send to though, because one has to change the address they are to send to at least every time one wants to spend what one has received.

For chains where one uses one persistent address, in order to allow other important features, then it could be more of an issue.

Still, I think solutions will probably be put in place before it becomes a real issue.

… hm, come to think of it, the use of public/private key pairs in cryptocurrencies, is, I think, pretty much exclusively used for signing, not for encrypting, right? In that case, it seems like an option based on hashes and ZKSNARKs should be able to play much the same role? So, even if all the purportedly quantum-safe alternatives to RSA and ECC end up vulnerable for the same reasons, I think probably something that only does the signing part should be possible? Or, hm, at least in the interactive setting…

If there's a strong enough consensus, everyone can just agree to migrate to some new technology and let the original go to zero.

There's no guarantees that breakthrough is coming anytime soon. Scaling up the number of qubits in a processor is very hard and it's why progress has been pretty slow over the last decade.

Unclear this will "happen for sure", but even if it did there are quantum-proof encryption techniques