There is the article that explains the reasons in detail. Summary: that specific node red plug-in has a different, more strict behaviour. We don’t want to disable SSL by default, so we have this weird in between state now