If I had resources commensurable with those able to successfully attack AES256 (which is a ridiculous level of economic resource by current understanding), I could attack Kyber by recovering the 256-bit seed value $d$ in Algorithm 4 of the Kyber specification. Note that the 256-bit derived value $\rho$ is known to me a smart of the public key and so by truncating the output of $G$ to 256-bits I have a 256-bit-to-256-bit function where I know an output $\rho$ and wish to find the corresponding input $d$. Whatever means I have to solve AES256 key recovery (e.g. 256-bit classical exhaustion or 128-bit Grover), I can presumably use to solve this similar problem. The only distinction is in the function evaluation which is either AES or SHA3. Recent work by Song estimates the Toffoli depth of a SHA3 quantum circuit to be 552 or total depth 2020; by comparison Grassl estimates a Toffoli depth for AES of 7488 or total depth 16408, so that AES256 key recovery is perhaps harder 8x harder than Kyber key recovery.
This is not the only way in which Kyber might be attackable with quantum resources. It is known that there is a connection between short vector problems and hidden dihedral subgroups, much as there is a connection between factoring/discrete logarithms and hidden abelian subgroups. However, analysis of how the quantum dihedral Fourier transform could be used to attack these problems has not yet had the success of shorts algorithm with the quantum abelian Fourier transform.
