. . .better solutions have been proposed and will be worth considering once they have withstood the test of time (i.e. “5 to 10 years in the field, and not broken yet”).
-From Thomas Pornin's excellent blog post on password hashing.
The quote seems to me to be a case of the chicken and the egg. New solutions need field experience, but until they get field experience they cannot be trusted, and hence cannot be used in the field.
The AES selection process somewhat avoided the problem by bringing a great deal of academic force to bear. Over five years, the best cryptographers in the world meticulously examined the submitted algorithms, with the result that Rijndael was chosen as the best compromise between security, speed, and usability.
But AES had the significant advantage that the standard it was replacing was demonstrably weak against modern computer hardware and in dire need of replacement. Most new protocols or algorithms don't have this hard limit to help them achieve prominence.
Given that the standard answer to "which algorithm?" or "which method?" is always "use the trusted", how do new solutions ever get their field experience? Does it rely on someone taking a leap of faith with their sensitive data, or does it rely on use of the new solution with non-sensitive data and then extrapolating based on that experience, or what?
(I understand that the quote's context was specifically related to password hashing. If generalizing from that to all security methods is unfair or off-base, knowing why would be useful.)