Aren’t many in cybersecurity still in denial about the threat? Haven’t these slumberers shown that they _won’t_ wake up until dramatic achievements in fault-tolerant QC roust them?

Given that reality, isn’t it better that it be done first by mostly US-based companies in the open, than by (let’s say) Chinese or Russian intelligence in secret?

Technically, it isn’t a part of the comparison internally but it is a factor that some users care for.

And if there's a suitable vulnerability, it might be possible to trigger it even without using <iframe>, <img> or <a> element, so it's not worth considering for this issue.