It's not just because the GPG user is small fry that 1024 bit RSA is low risk for them. It is mostly because there is only one of them. A nation state attacker

It's not just because the GPG user is small fry that 1024 bit RSA is low risk for them. It is mostly because there is only one of them. A nation state attacker would have to spend billions of dollars and years of lost opportunity to use their resource more effectively to get the messages/files of a single person. There are much cheaper and faster ways to accomplish the same thing. If, say, Gmail was using some static 1024 bit RSA based scheme things would be different. Then an attacker would get the messages of billions of users.