Someone who knows more correct me if I wrong, but my recollection is that the AES256/192 related key attack presented by Alex Biryukov and Dmitry Khovratovich (assuming that's what you're referring to) was seriously, seriously theoretical. Like, for real. Performing it required somehow getting the owner of the targeted key (K1) to use a specific derivation algorithm to derive 3 other keys from K1, then get the owner to perform encryption/decryption operations of the attacker's choosing using all 4 keys on up to 2^99.5 16-byte blocks, THEN the attacker uses ridiculous amounts of storage to to finish, I can't remember exactly how big but multiple exabytes of storage big.
I know how sometimes weaknesses are found that seem impossible at first but can somehow be improved, but unless something fundamental has changed in the years since that attack did not appear to have any actual significance beyond academics (which is why no one in the industry worried about it). Beyond any efficiency requirements is the basic least-common denominator actor issue: if an attacker can get a key owner (person or machine) to perform that level of arbitrary action, there are much much easier ways to subvert the entire system.
As a symmetric block cipher I suppose being in the habit of AES-256 usage is at least some gesture towards any future attacks by scalable general purpose quantum computers should they appear, since Grover's means it'd still be decent while 128 would drop to 64, though given the generally usage of asymmetric ciphers for initial exchange I don't know if it actually matters at all in the specific instance of the web. But whatever its benefits or downsides I don't think the related key attack makes it worse then AES-128.
I didn't mean to suggest that A256 was worse than A128 (though I see how it would read that way). I was just trying to point out that things are more complicated than comparing two numbers.
That being said, I don't know if I'd agree with anyone suggesting that A256 provides a meaningful increase in practical security over A128. As you said, the main difference is post-quantum and you can't just drop A256 in and say you are ready for post-quantum as you need a more holistic post-quantum solution anyway.
I know how sometimes weaknesses are found that seem impossible at first but can somehow be improved, but unless something fundamental has changed in the years since that attack did not appear to have any actual significance beyond academics (which is why no one in the industry worried about it). Beyond any efficiency requirements is the basic least-common denominator actor issue: if an attacker can get a key owner (person or machine) to perform that level of arbitrary action, there are much much easier ways to subvert the entire system.
As a symmetric block cipher I suppose being in the habit of AES-256 usage is at least some gesture towards any future attacks by scalable general purpose quantum computers should they appear, since Grover's means it'd still be decent while 128 would drop to 64, though given the generally usage of asymmetric ciphers for initial exchange I don't know if it actually matters at all in the specific instance of the web. But whatever its benefits or downsides I don't think the related key attack makes it worse then AES-128.