You are correct that AES's three key sizes are a result of the legacy of the military wanting "three levels of security" and NIST then asking for them. And sinc

You are correct that AES's three key sizes are a result of the legacy of the military wanting "three levels of security" and NIST then asking for them. And since there is no requirement that they actually be more or less secure, they are practically equivalent - except for the known weakness in AES256, and the other in AES192, that don't present in AES128. In this sense, AES256 is somewhat shittier than AES128, even though there is no practical threat to anyone right now. But in practice, the future does matter, both due to legacy systems and possible unknown attacks. If an unknown attack can drop the key space, and then over time that becomes a practical brute force, you've lost the game. Unless you raise your key size. It's important to remember all the legacy cryptosystems that exist in embedded devices, all the support contracts that expire, and all the companies that go under and leave products that can only be tweaked and not upgraded. Lots of industries (healthcare, academia, government, embedded devices, 3rd party software, etc) rely on these products, and the more IoT is pushed the more crap is going to make its way into products that will never receive a firmware update. In some (many?) cases they will use shitty crypto, and the only defense that shitty crypto will have against the future is increasing the key size. So the problem with your statement is you said key sizes don't matter. In reality, they just matter the least, right now.