Why haven't quantum computers factored 21 yet?

What does this mean about the size (and thus feasibility) of a circuit required to factor a cryptographically interesting number, say, to be generous, RSA1024?

Off topic, but are cryptographers convinced that on the new gigawatt data centers RSA1024 is infeasible to factor? I gather that the fastest known algorithms are still too slow to factor it in reasonable time. But is consensus that there will not be improvements to these algorithms in near future?

Number Field Sieves are still the best method, and the techniques are three or more decades old with only incremental improvements. (Of course there might be an incredible breakthrough tomorrow.)

best published method

Are the bitcoins in the first wallets gone? No? I will assume it's still the best method without any irrefutable evidence.

Bitcoin uses ECDSA to sign transactions, not RSA.

In addition, selling information to a government on how to break either system would be more valuable than the amount of bitcoin you would able to sell before exchanges stop accepting deposits or the price crashes.

If a government knows you have such information they’ll take it not buy it.

So your best bet would probably be to try to sell as many BTC as possible then give away the solution for free to your/a government.