"Memory hard" is a serious benefit that scrypt actually has.
"RSA tested and widely used" is subjective, not particularly meaningful, and in some senses erroneous, and so makes a poor case for PBKDF2.
If people want to seriously push for scrypt as a replacement for bcrypt as the "default" function, I'll design and print flags and pennants for the movement. But when people say "use PBKDF2 instead of bcrypt", I think the net effect is to scare people back to salted hashes, and my general response is going to be to poke holes in their arguments.
I just spent the past two days sitting in a workshop on "Special-Purpose Hardware for Attacking Cryptographic Systems" and the most repeating thread from all of the talks was how to deal with the unique memory limitations of GPU's and FPGA's when using them to attack crypto. Bandwidth is the largest one, and specifically the tiny amount of shared memory available to the GPU.
Basically, if you're forced to use "local memory" (which has a huge cost in transaction time), the amount of operations per cycle you can perform goes way down, which in some cases can be the difference between an attack taking "2 years" and "until the heat death of the universe".
Just to add to that a little: when comparing these functions it's not so relevant the absolute time consumed; all of them can be tuned to take whatever amount of time is acceptable on the defender's general purpose hardware.
The key factor is minimizing the relative advantage that an attacker with focused resources (such as dedicated hardware) is able to gain over the defender.
By consuming lots of RAM (more than will fit on a single Si die), it means effectively that the defender is able to leverage the economies of scale that go into optimizing the memory bus of his commodity server. This makes it so an attacker who can produce his own chips (or to a lesser extent, use FPGAs or GPUs) has much less of an advantage over the defender.
While CPU speeds, transistor densities, and cache sizes have gone through the roof, the 60-80 ns memory latency of off-chip DRAM has been nearly constant over the last few decades of computing.
"RSA tested and widely used" is subjective, not particularly meaningful, and in some senses erroneous, and so makes a poor case for PBKDF2.
If people want to seriously push for scrypt as a replacement for bcrypt as the "default" function, I'll design and print flags and pennants for the movement. But when people say "use PBKDF2 instead of bcrypt", I think the net effect is to scare people back to salted hashes, and my general response is going to be to poke holes in their arguments.