So that would make total supply around 16 million BTC. Some of these have a private key that is encrypted and the password forgotten, whereas others have lost the private key entirely, like the hard drive lost at the rubbish tip in Manchester in 2013 with a key for 800BTC on it. So the former will eventually be able to be brute-forced in coming decades when quantum computers can be accessed. But the lost keys are lost forever.
Wallet files are usually encrypted with symmetric cryptography like AES, so quantum computers actually won't be able to help a lot here, but a growing speed of regular computers might do the tricks, although it's hard to predict how many decades would it take to crack 128-bit AES.
But I would assume that most coins are lost in the second sense, with no encrypted file available, because that's what happened in early days - files were lost with OS reinstalls, hardware got thrown away, etc.
