>Currently, a 112-bit security strength for the classical digital signature and key-establishment algorithms does not appear to be in imminent danger of becoming insecure in the near future, so this approach should allow an orderly transition to quantum-resistant algorithms without unnecessary effort for the cryptographic community.
I get from this that NIST thinks the quantum threat is significantly greater than the threat from advances in classical computing hardware or algorithms. So we are to not to bother with transitioning from 112 bit to 128 bit equivalent strength and to concentrate on post quantum stuff. As a result stuff like 2048 bit RSA is now allowed at the "deprecated" level where it was previously "disallowed" after 2030.
It seems that both the quantum and classical threats both currently depend on a fundamental breakthrough so I am not sure how legitimate this policy is. It is reminiscent of the NSA suggestion to not bother transitioning to elliptic curve based methods and skip directly to post quantum methods.
Deprecating RSA-2048 for other reasons doesn't make much sense. Whatever is going to break RSA-2048 is likely to break all of RSA. The story we're commenting on is pretty clear that the motivation here is to streamline the logistics of moving to PQ cryptography.
Credible new systems aren't going to be developed with RSA, regardless.
