In my opinion, 10 years is definitely fine, 15 years is probably fine, 20 years would start making me a bit nervous that nation-states might have access to maturing quantum cryptography tech. But I know nothing about quantum tech other than they've been able to work with only a few qubits and that it's really, really hard to add more qubits to the action.