Historical reasons I believe and also because packages are signed. Though there’s been a few vulnerabilities that have made TLS (IMHO) a necessity. As well as just preventing snooping. Modern debian and apt should support TLS out of the box now.

Unlikely to be the problem, but I’d switch the config to use https URLs.

I’ve been using bose 700s for a long time. They do occasionally have goofy bluetooth behavior and the earcups have to be replaced if you use them heavily, but the bose sound profile I like a lot more than the sony.

I’ve tried XM5’s recently for more codecs, and I love them except for one thing, which was that the band over the top had hard plastic parts and not enough soft padding, so the headphones with my head shape had a tendency to painfully squeeze. Wearing a hat or putting something on the band helped though. Headphones were light and breathed a bit better than the 700s anyway (haven’t tried the QC 2).