it does not up the security posture that much. It helps in case a lot of key exchange traffic must be collected in order to derive the key progressively.
But in practice, it merely mitigates the impacts in case of compromise. Thats the reason why we are bugged with password and key rotation: so that in case its compromised, it cannot be reused (much longer).

people connecting to lots of servers often enable an option to skip checking host keys
By doing so, people understand they don't validate the host in any way, and expose themselves to mitm. I don't know anyone who does that. Its like going beyond the big fat warning while navigating to https://wrong.host.badssl.com/; or rather like disabling this warning in your browser settings.

HTTPS connections allow overlaying extra authentication methods
Once the ssh client authenticated the server, the server must authenticate the user which can be provided by various means. Moreover, the extra authentication methods you mention have nothing to do with tls, and in case the tls connection is compromised, you would be sending your credential in plain text. At the tls level, your server can validate a client certificate, thats it.

What does the digital id have to do with banning or shadow banning accounts from social media for whatever reason? Under my interpretation of current EU legislation, if social networks rely on this new id (which I think is likely), they would have to allow any citizen to join and participate without discrimination. Just like any business open to the public

Im reading male ligers (or tigons) are sterile. How can they produce fertile offsprings?

correction: one unsafe android application is less likely to cause problems to another application running on the same device than applications on a desktop OS. Also note considering: people usually grant all sorts of permissions to mobile applications without reason, so your silo is kind of falling apart already.

I agree such scanning lacks the context of the why the crypto is used. At the same time, the faulty code is most likely in a library, which is also lacking that context, and a good library should only rely on solid algorithms.

It sounds to me half of those hits are developers using outdated libraries still supporting broken crypto. I mean, I dont see any excuses for still using http without tls (rule 22, 593 hits), especially on a mobile device, and even if it is to communicate to a local server.