HQC's security rests on decoding random quasi-cyclic codes, a problem unrelated to lattices, so a breakthrough against ML-KEM would not affect it. Keys and ciphertexts are larger than ML-KEM's (several kilobytes at category 1) and operations slower, which is acceptable for a fallback.
NIST's original plan was a draft in about a year and a final standard in 2027; in 2026 the FIPS 207 team discussed requiring seed-only private keys. Until it is standardized, HQC is for experimentation and agility planning, not production.