Dear Maintainer,
with the upgrade from Buster to Bullseye the Security Archive Layout changed as mentioned here in the release notes:
https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.en.html#security-archive
When using the URL specified there (deb.debian.org) the checkbox for receiving security updates is not checked in the GUI and when checking it another line containing security.debian.org ... is added to sources.list.
As both URLs work and deb.debian.org seems to be the recommended official one I would expect both URLs to be recognized as valid URLs for security updates!?