Anecdotally, the .tk domain is a great idea in principle for giving so many people the opportunity to have their very own namespace for free. But like so many free things, bad actors(spammers, et. al) ruin it for the rest of us.
I’m a bit of a tin foil hat kind of a guy and for my own personal websites I prefer serving them with HTTPS and HSTS, but it’s more of a best practices thing and it’s not really a matter of life or death for my (very few) visitors.