In formal cryptography, we model algorithms (mostly our adversaries) as (Probabilistic) Turing Machines or as boolean circuits. In our lecture on formal cryptography, we learned that circuits are more powerful than turing machines, in the sense that every polynomial-time (probabilistic) turing machine can be represented by a polynomial-size circuit, but not every circuit can be represented as a polynomial-time turing machine.
As circuits are more powerful, it would intuitively make sense to use them instead of turing machines when modeling algorithms, as proving our system secure against a PPT turing machine does technically not imply security against polynomial-size circuits. However, since people are still using turing machines, I assume that this distinction is mostly irrelevant in practice.
Are there any practical differences between circuits and turing machines for cryptographic research (i.e. are there systems that are secure against PPT turing machines, but not polynomial-size circuits?) or does it exclusively come down to personal preference / convenience which one you use for your proofs?
Remark: I considered posting this to the computer science stack exchange, but decided against it as it is directly related to cryptography. If you disagree, feel free to migrate.