> Grover's algorithm more than "halves" the difficulty of AES, it square roots it.

Yes, but unfortunately it also makes it impossible to run the algorithm in parallel, making it more or less useless in practice.