Is there a good reason not to mention that ECC is weaker than RSA on a quantum computer? In most papers and other documents I see people are considering an ECC key of 256 bits equivalent to an RSA key of 3072 bits, which is true on a classical computer. But the amount of qubits required to crack RSA keys are estimated to be 2•bits while ECC is roughly 6•bits, which would make 256 bit ECC weaker than 1024 bit RSA.

|           RSA       |           ECC       |
| Key Length | qubits | Key Length | qubits |
|------------|--------|------------|--------|
| 1024       | 2048   | 163        | 1000   |
| 2048       | 4096   | 224        | 1300   |
| 3072       | 6144   | 256        | 1500   |
| 4096       | 8192   | 383        | 2300   |
| 15360      | 30720  | 512        | 3000   |


Source: https://security.stackexchange.com/a/96880

Is there a good reason to leave out that ECC is weaker than RSA on a quantum computer when writing a paper that involves comparing RSA to ECC? E.g. you want to promote the use of ECC over RSA.
I mainly see two reasons against comparing the quantum attack cost of RSA and ECC:


If your threat model includes (large) quantum computers, you should neither promote RSA nor ECC : they both scale badly against them, and any argument about which is stronger or weaker is marginal.
Since quantum computers large enough to be useful do not exist as of today (2017), it is to soon to compare precisely the two schemes, since the quantum computer’s architecture (as in “Von Neuman architecture”, not x86 vs PowerPC) is far from settled. Many different theoretical models exists (circuit model, measurement based quantum computers, Clifford computation with magic states, etc.), different universal sets of gates and fault-tolerant architectures are proposed, and work on quantum compilers is only starting. For a theoretician, this in “not really important because all these models are polynomially equivalent”, put this might easily reduce (or increase) the gap between ECC and RSA.